update: switch Terraform to NixOS template workflow

- Point clone_template to nixos-template and trim cloud-init to Nix-safe hostname/DNS only
- Remove SSH/Tailscale cloud-init variables and workflow secret dependencies
- Add reusable NixOS template-base config with bootloader, Tailscale, fish, and utility packages

terraform/cloud-init.tf

@@ -2,10 +2,8 @@ data "template_file" "cloud_init_global" {
   template = file("${path.module}/files/cloud_init_global.tpl")
 
   vars = {
-    hostname       = "generic"
-    domain         = "home.arpa"
-    TS_AUTHKEY     = var.TS_AUTHKEY
-    SSH_KEY_PUBLIC = var.SSH_KEY_PUBLIC
+    hostname = "generic"
+    domain   = "home.arpa"
   }
 }