feat: refactor infra to cp/wk kubeadm topology

Provision 3 thin control planes and 3 workers with role-specific sizing and VMID ranges (701/711), generate per-node cloud-init snippets with SSH key injection, and add NixOS kubeadm host/module scaffolding for cp-1..3 and wk-1..3.

terraform/files/cloud_init_global.tpl

@@ -1,4 +1,5 @@
 #cloud-config
+hostname: ${hostname}
 manage_etc_hosts: true
 resolv_conf:
   nameservers:
@@ -6,6 +7,7 @@ resolv_conf:
     - 1.1.1.1
 
 preserve_hostname: false
+fqdn: ${hostname}.${domain}
 
 users:
   - name: micqdf