initial implementation: terraform-provider-encapi

Terraform/OpenTofu provider for encapi (the Puppet ENC replacing Cobbler).
- resources: encapi_role (jsonencode default_params), encapi_status, encapi_node
- data sources: encapi_node, encapi_role
- client with bearer-token auth; unit tests; examples
- Makefile (package->zip), Woodpecker CI publishing to the artifactapi
  terraform-unkin registry on tag

examples/resources/encapi_node/main.tf

@@ -0,0 +1,10 @@
+resource "encapi_node" "example" {
+  certname    = "ausyd1nxvm2000.main.unkin.net"
+  role        = "roles::infra::storage::vault"
+  environment = "testing"
+
+  # Optional per-node overrides (win over the role's default_params).
+  params = jsonencode({
+    vault_role = "leader"
+  })
+}

examples/resources/encapi_role/main.tf

@@ -0,0 +1,12 @@
+resource "encapi_role" "minio" {
+  name        = "roles::infra::storage::minio"
+  description = "MinIO object storage node"
+
+  # Inheritable defaults, merged into every node with this role.
+  # Use jsonencode so numbers/bools keep their type in the ENC output.
+  default_params = jsonencode({
+    minio_pool = "pool1"
+    replicas   = 4
+    tls        = true
+  })
+}

examples/resources/encapi_status/main.tf

@@ -0,0 +1,14 @@
+# Statuses map to Puppet environments. Define as many as your estate uses;
+# a node can only be pinned to one that exists.
+resource "encapi_status" "testing" {
+  name = "testing"
+}
+
+resource "encapi_status" "production" {
+  name        = "production"
+  description = "Production environment"
+}
+
+resource "encapi_status" "development" {
+  name = "development"
+}