Populate terragrunt-enc: encapi ENC data as code

terragrunt-enc is the single source of truth for encapi ENC data (Puppet
statuses, roles, and node classifications), managed with Terraform/Terragrunt.
It supersedes Cobbler classification for Puppet and the terraform-incus
dual-write prototype (PR #39).

- Add modules/encapi (encapi_status / encapi_role / encapi_node, nodes
  FK-ordered after their role and status).
- Add config/encapi leaf: 3 statuses, 51 roles, and 143 node assignments
  (130 container VMs env production + 13 prodnxsr physicals env develop),
  all YAML-driven.
- Add config/root.hcl (consul backend infra/terraform/enc/<leaf>/state) and
  the encapi provider from the artifactapi registry (v0.1.0).
- Add Makefile, Woodpecker pre-commit/plan/apply pipelines, pre-commit
  config, ci/extract_incus_nodes.py, and expand the README.

modules/encapi/main.tf

@@ -0,0 +1,29 @@
+resource "encapi_status" "this" {
+  for_each = var.statuses
+
+  name        = each.key
+  description = each.value.description
+}
+
+resource "encapi_role" "this" {
+  for_each = var.roles
+
+  name           = each.key
+  description    = each.value.description
+  default_params = each.value.default_params == null ? null : jsonencode(each.value.default_params)
+}
+
+resource "encapi_node" "this" {
+  for_each = var.nodes
+
+  certname    = each.key
+  role        = each.value.role
+  environment = each.value.environment
+  params      = each.value.params == null ? null : jsonencode(each.value.params)
+
+  # Nodes FK-require their role and status to exist first.
+  depends_on = [
+    encapi_role.this,
+    encapi_status.this,
+  ]
+}

modules/encapi/providers.tf

@@ -0,0 +1,10 @@
+provider "encapi" {
+  endpoint = var.encapi_endpoint
+  # token defaults to the ENCAPI_WRITE_TOKEN environment variable
+}
+
+variable "encapi_endpoint" {
+  description = "The encapi server base URL."
+  type        = string
+  default     = "https://encapi.k8s.syd1.au.unkin.net"
+}

modules/encapi/variables.tf

@@ -0,0 +1,37 @@
+variable "statuses" {
+  description = <<EOT
+Map of encapi statuses (Puppet environments) to seed. Keyed by status name.
+Each value may carry an optional description.
+EOT
+  type = map(object({
+    description = optional(string)
+  }))
+  default = {}
+}
+
+variable "roles" {
+  description = <<EOT
+Map of encapi roles to seed. Keyed by role class name (e.g. roles::base).
+Each value may carry an optional description and a default_params object that
+is jsonencode()'d into the role's inheritable defaults.
+EOT
+  type = map(object({
+    description    = optional(string)
+    default_params = optional(any)
+  }))
+  default = {}
+}
+
+variable "nodes" {
+  description = <<EOT
+Map of encapi node assignments to seed. Keyed by certname. Each value pins the
+node to a role and environment (which must exist as a role/status above), with
+optional per-node params jsonencode()'d into the ENC output.
+EOT
+  type = map(object({
+    role        = string
+    environment = string
+    params      = optional(any)
+  }))
+  default = {}
+}

modules/encapi/versions.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    encapi = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi"
+      version = "0.1.0"
+    }
+  }
+}