feat: refactor infra to cp/wk kubeadm topology

Provision 3 thin control planes and 3 workers with role-specific sizing and VMID ranges (701/711), generate per-node cloud-init snippets with SSH key injection, and add NixOS kubeadm host/module scaffolding for cp-1..3 and wk-1..3.

.gitea/workflows/terraform-destroy.yml

@@ -15,8 +15,8 @@ on:
         type: choice
         options:
           - all
-          - alpacas
-          - llamas
+          - control-planes
+          - workers
 
 concurrency:
   group: terraform-global
@@ -77,11 +77,11 @@ jobs:
             all)
               terraform plan -destroy -out=tfdestroy
               ;;
-            alpacas)
-              terraform plan -destroy -target=proxmox_vm_qemu.alpacas -out=tfdestroy
+            control-planes)
+              terraform plan -destroy -target=proxmox_vm_qemu.control_planes -out=tfdestroy
               ;;
-            llamas)
-              terraform plan -destroy -target=proxmox_vm_qemu.llamas -out=tfdestroy
+            workers)
+              terraform plan -destroy -target=proxmox_vm_qemu.workers -out=tfdestroy
               ;;
             *)
               echo "Invalid destroy target: ${{ inputs.target }}"