Dual-write ENC data into encapi alongside Cobbler

Seed encapi (statuses, roles, prodnxsr node assignments) and make the
instance module also create an encapi_node for every VM, so the k8s
puppetserver ENC can cut over from Cobbler. Cobbler/puppetca/puppetdb
resources are left untouched.

- Add config/encapi leaf + modules/encapi driving statuses/roles/nodes
  from YAML (3 statuses, 51 roles, 13 prodnxsr physical nodes).
- Add encapi_node to modules/instance (certname, role, environment).
- Wire encapi provider into root.hcl required_providers and the module
  providers; plumb ENCAPI_WRITE_TOKEN via Makefile vault_env.

modules/encapi/main.tf

@@ -0,0 +1,29 @@
+resource "encapi_status" "this" {
+  for_each = var.statuses
+
+  name        = each.key
+  description = each.value.description
+}
+
+resource "encapi_role" "this" {
+  for_each = var.roles
+
+  name           = each.key
+  description    = each.value.description
+  default_params = each.value.default_params == null ? null : jsonencode(each.value.default_params)
+}
+
+resource "encapi_node" "this" {
+  for_each = var.nodes
+
+  certname    = each.key
+  role        = each.value.role
+  environment = each.value.environment
+  params      = each.value.params == null ? null : jsonencode(each.value.params)
+
+  # Nodes FK-require their role and status to exist first.
+  depends_on = [
+    encapi_role.this,
+    encapi_status.this,
+  ]
+}