Harden public infrastructure and extract deployment identity

[jaredjakacky]

Summary

• make the public Terraform root module deployment-neutral
• replace committed operator SSH keys with validated runtime inputs
• require unique canonical IPv4 /32 SSH administration sources
• remove the production HCP Terraform organization and workspace from public source
• enforce a validated key-only OpenSSH policy while retaining local forwarding for an SSH API tunnel
• ignore saved Terraform plans and document the public/private trust boundary
• add executable security contract tests and a dedicated CI workflow

Security findings addressed

1. Production server identity, Hetzner placement, HCP Terraform destination, and operator key material were coupled to public source.
2. SSH source CIDRs accepted overly broad or duplicate networks and were hidden from plan review as a sensitive value.
3. The host role did not explicitly enforce key-only SSH or disable alternative authentication and forwarding paths.
4. Local saved plan files were not actually ignored despite the comment in .gitignore.

Compatibility and deployment notes

• Existing Terraform resource addresses are unchanged; this PR does not introduce state moves.
• The companion live-repository PR supplies TF_VAR_deployment, the administrator public key, SSH source CIDRs, and HCP Terraform identity.
• Configure the companion live repository's production Environment before running Terraform from this commit.
• Hetzner injects an SSH key only when a server is created. Changing the Terraform key resource does not rotate authorized_keys on an existing host.
• Node convergence writes an OpenSSH drop-in, validates its syntax, verifies the effective root-login policy, and validates the daemon again before reload.

Validation

CI exercises Terraform formatting/validation, immutable workflow policy, the new Terraform deployment security contract, the OpenSSH hardening contract, Ansible lint and syntax, and the existing kubeadm/Cilium lifecycle tests.

Companion private PR: https://github.com/jaredjakacky/single-node-kubernetes-live/pull/16