Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/openbao/terraform/policies.tf

@@ -0,0 +1,27 @@
+# Policy bodies live in policies/*.hcl so they stay readable and diffable.
+# Exported verbatim from the running instance, so importing produces no diff.
+#
+# OVERLAP WARNING: ../ansible (role openbao_bootstrap) also writes these — hence
+# the "# Ansible managed" header still inside each file. Gate those Ansible tasks
+# off before applying, or the two will overwrite each other on alternate runs.
+resource "vault_policy" "admin" {
+  name   = "admin"
+  policy = file("${path.module}/policies/admin.hcl")
+}
+
+resource "vault_policy" "ai_agent_ssh" {
+  name   = "ai-agent-ssh"
+  policy = file("${path.module}/policies/ai-agent-ssh.hcl")
+}
+
+resource "vault_policy" "snapshot" {
+  name   = "snapshot"
+  policy = file("${path.module}/policies/snapshot.hcl")
+}
+
+# Read-only kv/k8s/* for the External Secrets Operator. Unlike the three above
+# this one is NOT also written by Ansible, so there is no overlap to gate off.
+resource "vault_policy" "external_secrets" {
+  name   = "external-secrets"
+  policy = file("${path.module}/policies/external-secrets.hcl")
+}