Add infra/ with student-vms OpenTofu root module

- infra/pve: host facts, IP plan, one-time setup
- infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0
- infra/sandbox: template clones for throwaway test VMs
- README/TODO: Windows DC/AD instead of FreeIPA, new network
- .gitignore: only ignore secrets.auto.tfvars instead of all tfvars

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/tofu/student-vms/variables.tf

@@ -0,0 +1,16 @@
+variable "pve_api_token" {
+  type        = string
+  description = "Proxmox API token, e.g. tofu@pve!tofu=<secret>"
+  sensitive   = true
+}
+
+variable "pve_ssh_user" {
+  type        = string
+  description = "SSH user on the PVE host for the snippet upload"
+}
+
+variable "ssh_public_key_file" {
+  type        = string
+  description = "Public key added to the VM user admin"
+  default     = "~/.ssh/id_ed25519.pub"
+}