Add infra/ with student-vms OpenTofu root module

- infra/pve: host facts, IP plan, one-time setup
- infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0
- infra/sandbox: template clones for throwaway test VMs
- README/TODO: Windows DC/AD instead of FreeIPA, new network
- .gitignore: only ignore secrets.auto.tfvars instead of all tfvars

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/tofu/student-vms/providers.tf

@@ -0,0 +1,11 @@
+provider "proxmox" {
+  endpoint  = "https://10.100.200.50:8006/"
+  api_token = var.pve_api_token
+  insecure  = true # self-signed certificate
+
+  # Used to upload the cloud-init snippets, key comes from the ssh-agent
+  ssh {
+    agent    = true
+    username = var.pve_ssh_user
+  }
+}