Add infra/ with student-vms OpenTofu root module

- infra/pve: host facts, IP plan, one-time setup
- infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0
- infra/sandbox: template clones for throwaway test VMs
- README/TODO: Windows DC/AD instead of FreeIPA, new network
- .gitignore: only ignore secrets.auto.tfvars instead of all tfvars

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/sandbox/README.md

@@ -0,0 +1,13 @@
+# sandbox
+
+Throwaway test VMs, not managed by OpenTofu. Clone a template on the PVE host (as root), use VMIDs `9990-9999`:
+
+```bash
+qm clone 903 9991 --name test-01 --full
+qm set 9991 --ipconfig0 ip=dhcp
+qm start 9991
+# done testing
+qm stop 9991 && qm destroy 9991
+```
+
+Login: `ssh admin@<ip>` (IP via `qm guest cmd 9991 network-get-interfaces`).