Dual-write ENC data into encapi alongside Cobbler

Seed encapi (statuses, roles, prodnxsr node assignments) and make the
instance module also create an encapi_node for every VM, so the k8s
puppetserver ENC can cut over from Cobbler. Cobbler/puppetca/puppetdb
resources are left untouched.

- Add config/encapi leaf + modules/encapi driving statuses/roles/nodes
  from YAML (3 statuses, 51 roles, 13 prodnxsr physical nodes).
- Add encapi_node to modules/instance (certname, role, environment).
- Wire encapi provider into root.hcl required_providers and the module
  providers; plumb ENCAPI_WRITE_TOKEN via Makefile vault_env.

modules/instance/main.tf

@@ -97,6 +97,17 @@ resource "puppetdb_node" "this" {
   depends_on = [incus_instance.this]
 }
 
+# Dual-write the ENC assignment into encapi alongside the Cobbler system above.
+# The role and environment must already exist in encapi (seeded by the
+# config/encapi leaf); apply that leaf before the instance leaves.
+resource "encapi_node" "this" {
+  certname    = "${var.name}.${var.cobbler_domain}"
+  role        = var.cobbler_mgmt_classes[0]
+  environment = var.encapi_environment
+
+  depends_on = [incus_instance.this]
+}
+
 resource "null_resource" "wait_for_instance_ready" {
   depends_on = [incus_instance.this]