Add infra/ with student-vms OpenTofu root module

- infra/pve: host facts, IP plan, one-time setup
- infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0
- infra/sandbox: template clones for throwaway test VMs
- README/TODO: Windows DC/AD instead of FreeIPA, new network
- .gitignore: only ignore secrets.auto.tfvars instead of all tfvars

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/tofu/student-vms/README.md

@@ -0,0 +1,15 @@
+# student-vms
+
+One Debian 13 VM per student (`vm-00`, `vm-01`, …, IPs `10.100.200.80-100`), created with [tf-mod-pve](https://github.com/CubelaPetar/tf-mod-pve). The VM list is in `vms.tf`.
+
+Prerequisites: host setup from [`../../pve/README.md`](../../pve/README.md) and your SSH key authorized for `sbxadmin` on the host.
+
+```bash
+ssh-add ~/.ssh/id_ed25519                            # provider uploads snippets via ssh-agent
+cp secrets.auto.tfvars.example secrets.auto.tfvars   # fill in the API token
+tofu init
+tofu plan
+tofu apply
+```
+
+State is local (`terraform.tfstate`, gitignored). Back it up.