Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

apps/smtp-relay/terraform/main.tf

@@ -0,0 +1,50 @@
+# Entra app registration for the Postfix sasl-xoauth2 relay.
+# Delegated Microsoft Graph SMTP.Send + admin consent + a client secret. The relay
+# still needs a one-time device-code login to mint the refresh token (see ../README.md).
+
+data "azuread_client_config" "current" {}
+
+# Microsoft Graph well-known IDs, so we don't hardcode the SMTP.Send permission UUID.
+data "azuread_application_published_app_ids" "well_known" {}
+
+resource "azuread_service_principal" "msgraph" {
+  client_id    = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
+  use_existing = true
+}
+
+resource "azuread_application" "smtp_relay" {
+  display_name     = var.app_display_name
+  sign_in_audience = "AzureADMyOrg"
+
+  # Enables "Allow public client flows" so the device-code flow works, while we still
+  # keep a client secret for confidential refresh.
+  fallback_public_client_enabled = true
+
+  public_client {
+    redirect_uris = ["https://login.microsoftonline.com/common/oauth2/nativeclient"]
+  }
+
+  required_resource_access {
+    resource_app_id = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
+
+    resource_access {
+      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["SMTP.Send"]
+      type = "Scope" # delegated
+    }
+  }
+}
+
+resource "azuread_service_principal" "smtp_relay" {
+  client_id = azuread_application.smtp_relay.client_id
+}
+
+# NOTE: no client secret. This is a PUBLIC client (device-code delegated flow); the
+# refresh token is the credential. Presenting a secret makes Entra reject the refresh
+# with AADSTS700025 ("Client is public..."). CLIENT_SECRET in the k8s secret is empty.
+
+# Org-wide admin consent for the delegated SMTP.Send scope (no per-user consent prompt).
+resource "azuread_service_principal_delegated_permission_grant" "smtp_send" {
+  service_principal_object_id          = azuread_service_principal.smtp_relay.object_id
+  resource_service_principal_object_id = azuread_service_principal.msgraph.object_id
+  claim_values                         = ["SMTP.Send"]
+}