Add infra/ with student-vms OpenTofu root module

- infra/pve: host facts, IP plan, one-time setup
- infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0
- infra/sandbox: template clones for throwaway test VMs
- README/TODO: Windows DC/AD instead of FreeIPA, new network
- .gitignore: only ignore secrets.auto.tfvars instead of all tfvars

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -1,5 +1,5 @@
 
-# Learning Plattform for Students
+# Learning Platform for Students
 
 ## init
 
@@ -21,47 +21,32 @@ Build a reliable platform on a pve host to teach students Linux/Windows server a
 
 ## User Management
 
-Apart from the pve host, the main core of the environment will be a _FreeIPA_ Server which combines
+A Windows Server DC/AD is the identity and DNS server of the lab. Each student gets an AD account and is in the group `linux_students` (further groups: `linux_admins`, `linux_users`). Student VMs join the domain.
 
-- identity management server (ldap, sso, acl, ...) via a 389 directory server
-- DNS server (bind) 
-- NTP server
-- Kerberos
-- Dogtag for certificate management
-- NFS server or 'advertise' one for home folders of all users and other userful shares when needed in an exercise
+Additional DCs and firewalls/routers are built by the students as exercises.
 
+## Repo layout
 
-We will setup user accounts for each student on the ipa server and a home folder for each one which are shared via nfs 
-and automatically mounted on user login on any device in the domain/realm.
-The student will always have their files available no matter the device they login with their own account.
-
-Define designated groups, `linux_admins`, `linux_students`, `linux_users`, with each its own ACLs mediated via the ipa server. 
-
+- `exercises/`: exercise sheets
+- `infra/pve/`: PVE host facts, IP plan, one-time setup
+- `infra/tofu/<role>/`: one OpenTofu root module (and state) per role, e.g. `student-vms`
+- `infra/sandbox/`: throwaway test VMs (template clones, no OpenTofu)
 
 ## Facts
 
-**Domain:**
-
-- domain:   `lab.softbox.net`
-- realm:    `LAB.SOFTBOX.NET` 
-- ipa:
-    - hostname:     `ipa.lab.softox.net`
-    - ip address:   `10.11.12.65/24`
-
+**Domain:** `lab.softbox.net`
 
 **Students:**
 
 - username:                 `firstname.surname`
-- mail:                      `firstname.surname@softbox.de`
-- user_ssh_public_key:      Created in exercise sheet-00
-- uid:                      `1000-1020`
-- gid:                       `1000-1020`
-- groups:                    `linux_students` 
+- mail:                     `firstname.surname@softbox.de`
+- user_ssh_public_key:      created in exercise sheet-00
+- groups:                   `linux_students`
 
 **VMs:**
 
-- hostname:     `vm_00`
-- IP addresses: `10.11.12.200-220`
+- hostname:     `vm-00` … `vm-20`
+- IP addresses: `10.100.200.80-100` (see [infra/pve/README.md](infra/pve/README.md))
 
 ## Schedule