Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/openbao/terraform/ssh.tf

@@ -0,0 +1,21 @@
+# SSH certificate authority for machine/agent access.
+# The CA KEYPAIR itself is NOT managed here (see mounts.tf) — only this role,
+# which is what actually constrains what a signed cert may do.
+resource "vault_ssh_secret_backend_role" "ai_agent" {
+  backend  = vault_mount.ssh_client_signer.path
+  name     = "ai-agent"
+  key_type = "ca"
+
+  allow_user_certificates = true
+  default_user            = "ansible"
+  allowed_users           = "*"
+
+  # Deliberately short: access is scoped by TTL + principals rather than by
+  # source IP, so a leaked cert expires in minutes.
+  ttl     = 300 # 5m
+  max_ttl = 900 # 15m
+
+  default_extensions = {
+    "permit-pty" = ""
+  }
+}