feat: add IaC layer with shared var/t1 and var/t3 data paths

Ansible provisions the k3d cluster and Flux controllers; Terraform
modules deploy the simulated fleet and ground warehouse. Compose and
k3d share var/t1 (live lake) and var/t3 (warehouse). The prototype
gains a live mode fed by the explorer read-only SQL API.

infra/ansible/templates/swarm-data-plane.service.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Swarm data plane (Compose bundle, release {{ manifest.release }})
+After=docker.service wg-quick@wg0.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory={{ swarm_home }}/release
+ExecStart=/usr/bin/docker compose up -d
+ExecStop=/usr/bin/docker compose down
+TimeoutStartSec=300
+
+[Install]
+WantedBy=multi-user.target

infra/ansible/templates/wg0.conf.j2

@@ -0,0 +1,12 @@
+# WireGuard swarm plane — rendered by drone-provision.yml
+[Interface]
+Address = {{ wg_address }}
+ListenPort = {{ wg_port }}
+PrivateKey = __REPLACED_FROM_HSM_AT_SEALING__
+
+{% for peer in groups['drones'] | difference([inventory_hostname]) %}
+[Peer]
+# {{ peer }}
+PublicKey = __PEER_{{ peer | upper | replace('-', '_') }}_PUBKEY__
+AllowedIPs = {{ hostvars[peer].wg_address | ansible.utils.ipaddr('address') }}/32
+{% endfor %}