feat: add IaC layer with shared var/t1 and var/t3 data paths

Ansible provisions the k3d cluster and Flux controllers; Terraform
modules deploy the simulated fleet and ground warehouse. Compose and
k3d share var/t1 (live lake) and var/t3 (warehouse). The prototype
gains a live mode fed by the explorer read-only SQL API.

infra/ansible/templates/wg0.conf.j2

@@ -0,0 +1,12 @@
+# WireGuard swarm plane — rendered by drone-provision.yml
+[Interface]
+Address = {{ wg_address }}
+ListenPort = {{ wg_port }}
+PrivateKey = __REPLACED_FROM_HSM_AT_SEALING__
+
+{% for peer in groups['drones'] | difference([inventory_hostname]) %}
+[Peer]
+# {{ peer }}
+PublicKey = __PEER_{{ peer | upper | replace('-', '_') }}_PUBKEY__
+AllowedIPs = {{ hostvars[peer].wg_address | ansible.utils.ipaddr('address') }}/32
+{% endfor %}