Add infra/ with student-vms OpenTofu root module

- infra/pve: host facts, IP plan, one-time setup
- infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0
- infra/sandbox: template clones for throwaway test VMs
- README/TODO: Windows DC/AD instead of FreeIPA, new network
- .gitignore: only ignore secrets.auto.tfvars instead of all tfvars

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/tofu/student-vms/secrets.auto.tfvars.example

@@ -0,0 +1,3 @@
+# Copy to secrets.auto.tfvars (gitignored) and fill in
+pve_api_token = "tofu@pve!tofu=<secret>"
+pve_ssh_user  = "sbxadmin"