Add infra/ with student-vms OpenTofu root module

- infra/pve: host facts, IP plan, one-time setup
- infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0
- infra/sandbox: template clones for throwaway test VMs
- README/TODO: Windows DC/AD instead of FreeIPA, new network
- .gitignore: only ignore secrets.auto.tfvars instead of all tfvars

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/pve/README.md

@@ -0,0 +1,41 @@
+# PVE host
+
+- Host: `pve` (`10.100.200.50`), Proxmox VE 9.2, 6 cores, 31 GiB RAM
+- Storage: `local` (dir: ISOs, snippets), `local-lvm` (VM disks)
+- Network: `vmbr0` on `10.100.200.0/24`, gateway and current DNS `10.100.200.4`
+- Templates: `903` `temp-debian-13`
+
+## IP plan (10.100.200.0/24)
+
+| Address | Use | Size |
+|---|---|---|
+| `.4` | Gateway, current DNS | |
+| `.50` | PVE host | |
+| `.70` | DC/AD `dc01.lab.softbox.net` (planned) | 2 vCPU, 4-8 GB |
+| `.80-.100` | Student VMs (`vm-00`, …), VMID `1080-1100`, 5-10 planned | 1 vCPU, 1 GB |
+| `.101-.211` | In use by other devices (probably DHCP) | |
+
+## One-time setup (as root, done)
+
+```bash
+# 1. Allow snippets on local storage
+pvesm set local --content iso,vztmpl,backup,import,snippets
+
+# 2. API user and token for OpenTofu; put the printed value into
+#    infra/tofu/<role>/secrets.auto.tfvars as pve_api_token = "tofu@pve!tofu=<value>"
+pveum user add tofu@pve --comment "OpenTofu"
+pveum aclmod / -user tofu@pve -role PVEAdmin
+pveum user token add tofu@pve tofu --privsep 0
+
+# 3. sudo for sbxadmin; passwordless rules for the snippet upload of the bpg/proxmox provider
+usermod -aG sudo sbxadmin
+cat > /etc/sudoers.d/sbxadmin-tofu <<'EOF'
+sbxadmin ALL=(root) NOPASSWD: /usr/sbin/pvesm apiinfo
+sbxadmin ALL=(root) NOPASSWD: /usr/bin/tee ^/var/lib/vz/snippets/[a-zA-Z0-9_][a-zA-Z0-9_.-]*$
+EOF
+chmod 440 /etc/sudoers.d/sbxadmin-tofu && visudo -c
+
+# 4. Templates: tf-mod-pve/scripts/create_template.sh, copied to /root/templates/ with
+#    storage=local-lvm, ssh_keyfile=/root/.ssh/authorized_keys, only temp-debian-13 enabled
+cd /root/templates && bash create_template.sh
+```