Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/openbao/terraform/imports.tf

@@ -0,0 +1,70 @@
+# Adopt the already-running OpenBao configuration into Terraform state.
+#
+# These use TF 1.5 `import` blocks rather than `terraform import` CLI calls so
+# the adoption is reviewable: `terraform plan` shows exactly what Terraform
+# thinks differs from reality BEFORE anything is written.
+#
+# The plan should be "N to import, 0 to destroy". Anything proposing a DESTROY
+# or a replace means the HCL does not match the live object — fix the HCL, never
+# apply through it. Destroying the pki mount would take the root CA with it.
+#
+# Once applied, these blocks are inert and can be deleted.
+
+import {
+  to = vault_mount.kv
+  id = "kv"
+}
+
+import {
+  to = vault_mount.pki
+  id = "pki"
+}
+
+import {
+  to = vault_mount.ssh_client_signer
+  id = "ssh-client-signer"
+}
+
+import {
+  to = vault_pki_secret_backend_role.bao_server
+  id = "pki/roles/bao-server"
+}
+
+import {
+  to = vault_ssh_secret_backend_role.ai_agent
+  id = "ssh-client-signer/roles/ai-agent"
+}
+
+import {
+  # NOTE: vault_auth_backend imports by the BARE path ("oidc"), not the
+  # API-prefixed "auth/oidc" — the latter gives "Cannot import non-existent
+  # remote object". The ROLE below does use the full path, which is the
+  # inconsistency that makes this easy to get wrong.
+  to = vault_auth_backend.oidc
+  id = "oidc"
+}
+
+import {
+  to = vault_jwt_auth_backend_role.admin
+  id = "auth/oidc/role/admin"
+}
+
+import {
+  to = vault_policy.admin
+  id = "admin"
+}
+
+import {
+  to = vault_policy.ai_agent_ssh
+  id = "ai-agent-ssh"
+}
+
+import {
+  to = vault_policy.snapshot
+  id = "snapshot"
+}
+
+import {
+  to = vault_pki_secret_backend_config_urls.this
+  id = "pki/config/urls"
+}