feat: consolidate infrastructure into Terraform + terraform destroy cleanup

Major provisioning pipeline changes:

Terraform:
- Add kreuzwerker/docker provider to manage iSCSI and NFS storage
  containers alongside PVE VMs in a single Terraform config
- New storage.tf with Docker container, image, and volume resources
- docker_host_ip variable for PVE nodes to reach storage services

Provisioning:
- Replace docker-compose storage management with Terraform
- Replace create-api-token.sh with wait-for-pve.sh (IP discovery +
  API readiness + auth verification only — no token creation)
- Tests use root@pam credentials, not API tokens

Cleanup:
- Replace preflight-cleanup.sh loop with terraform destroy
- Supports version filtering: cleanup 9 destroys only PVE 9 resources
- Full cleanup also removes config.json and tfvars

New commands:
- taint [8|9|all]: marks VMs for recreation on next provision
- dev.ps1 -Reprovision: runs taint before provision to force VM rebuild

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/dev.ps1

@@ -39,6 +39,11 @@
 .PARAMETER Rebuild
     Rebuild container images from scratch.
 
+.PARAMETER Reprovision
+    When used with -Provision, taints the PVE VMs in Terraform state
+    before applying, forcing them to be destroyed and recreated.
+    Useful when the VMs are in a bad state (e.g. clustered, broken).
+
 .PARAMETER Tests
     Filter integration tests by area name. Comma-separated list of test
     area names that match the numbered file prefixes. Examples:
@@ -86,6 +91,7 @@ param(
     [switch] $Cleanup,
     [switch] $Stop,
     [switch] $Rebuild,
+    [switch] $Reprovision,
 
     [string[]] $Tests,
 
@@ -229,6 +235,10 @@ if ($Test) {
 
 if ($Provision) {
     Start-InfraContainer
+    if ($Reprovision) {
+        docker exec $InfraContainer bash $RunIntegration taint $Version
+        if ($LASTEXITCODE -ne 0) { throw "Taint failed (exit code $LASTEXITCODE)" }
+    }
     docker exec $InfraContainer bash $RunIntegration provision $Version
     if ($LASTEXITCODE -ne 0) { throw "Provisioning failed (exit code $LASTEXITCODE)" }
 }