Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

terraform/proxmox/main.tf

@@ -0,0 +1,51 @@
+# Proxmox import-first workflow
+#
+# 1) Add one minimal resource block for one existing VM.
+# 2) Add an import block for that VM using the provider's required import ID format.
+# 3) Run:
+#      terraform init
+#      terraform plan
+#   or:
+#      ../scripts/reconcile_from_plan.sh -- -var-file=terraform.tfvars
+# 4) Review generated config carefully.
+# 5) Move only the useful arguments into a hand-maintained .tf file.
+# 6) Repeat until `terraform plan` is a no-op.
+
+# IMPORTANT:
+# - Start with exactly ONE existing VM.
+# - Do not apply until plan is clean.
+# - Confirm the provider's exact import ID format before running import/plan.
+# - Do not import your whole environment at once.
+
+# Example placeholder for one existing VM
+#resource "proxmox_virtual_environment_vm" "server-nixos" {
+#  name      = "server-nixos"
+#  node_name = "pve"
+#}
+
+# Example import block
+# REPLACE the id below with the exact import ID format required by your provider.
+# This is provider-specific and must be confirmed before use.
+#
+# Commonly this will involve the Proxmox node name and VM ID in some form.
+#
+import {
+  to = proxmox_virtual_environment_vm.nix-cache
+  id = "pve/105"
+}
+import {
+  to = proxmox_virtual_environment_vm.server-nixos
+  id = "pve/104"
+}
+import {
+  to = proxmox_virtual_environment_vm.pihole
+  id = "pve/108"
+}
+import {
+  to = proxmox_virtual_environment_vm.pbs
+  id = "pve/106"
+}
+import {
+  to = proxmox_virtual_environment_vm.docker
+  id = "pve/103"
+}