feat: refactor infra to cp/wk kubeadm topology

Provision 3 thin control planes and 3 workers with role-specific sizing and VMID ranges (701/711), generate per-node cloud-init snippets with SSH key injection, and add NixOS kubeadm host/module scaffolding for cp-1..3 and wk-1..3.

terraform/cloud-init.tf

@@ -1,12 +1,33 @@
-data "template_file" "cloud_init_global" {
+data "template_file" "control_plane_cloud_init" {
+  count    = var.control_plane_count
   template = file("${path.module}/files/cloud_init_global.tpl")
 
   vars = {
+    hostname       = "cp-${count.index + 1}"
+    domain         = "home.arpa"
     SSH_KEY_PUBLIC = var.SSH_KEY_PUBLIC
   }
 }
 
-resource "local_file" "cloud_init_global" {
-  content  = data.template_file.cloud_init_global.rendered
-  filename = "${path.module}/files/rendered/cloud_init_global.yaml"
+resource "local_file" "control_plane_cloud_init" {
+  count    = var.control_plane_count
+  content  = data.template_file.control_plane_cloud_init[count.index].rendered
+  filename = "${path.module}/files/rendered/cp-${count.index + 1}.yaml"
+}
+
+data "template_file" "worker_cloud_init" {
+  count    = var.worker_count
+  template = file("${path.module}/files/cloud_init_global.tpl")
+
+  vars = {
+    hostname       = "wk-${count.index + 1}"
+    domain         = "home.arpa"
+    SSH_KEY_PUBLIC = var.SSH_KEY_PUBLIC
+  }
+}
+
+resource "local_file" "worker_cloud_init" {
+  count    = var.worker_count
+  content  = data.template_file.worker_cloud_init[count.index].rendered
+  filename = "${path.module}/files/rendered/wk-${count.index + 1}.yaml"
 }