feat(provision): 弹性节点基建 Terraform + 一键更换 (tsk_6u0FxmbC7Yeq)

IaC 面 (infra/) 与控制面 (server/internal/provision) 双产出，落地 doc/04 §4
「节点是牲口」弹性拓扑与 make-before-break 一键更换。

server/internal/provision:
- CloudAdapter 适配层 + Registry（首发 vultr 消耗品池 / hetzner 精品池各一）；
  厂商凭证仅从 PROVISION_<VENDOR>_* env 注入，不入库不入 git。
- ProvisionService：CreateNode(幂等键重放不重复开机)、DestroyNode(幂等)、
  RotateIP(换 IP 不换机 + version bump)、ListProviders。
- Replace 一键更换：先建后拆，新机 up 先于旧机 draining（容量不下降），
  replacement_uuid 幂等键 + replacements 表分步记录，崩溃可续跑不重复。
- RotatePool：池内滚动轮换，并发度 1–2。
- cmd/nodectl CLI：create/destroy/rotate-ip/replace/rotate-pool/providers。
- 单测（mock 厂商 API + 内存 Store）：幂等重放、make-before-break 时序断言、
  开机失败/探活超时→destroyed+失败计数+告警钩子、崩溃续跑、RotatePool。

infra/:
- terraform/：探针机 + 控制面基线模块化（probe / control-plane）+ README，
  低频基线进 state，节点不进 Terraform。
- cloud-init/node.yaml.tmpl：节点引导模板（注入一次性 bootstrap token，task #5）。
- identity-isolation.md：身份隔离登记表（doc/06 §2 红线，无任何凭证）。

migrations/000008：nodes 增 provider_instance_id/elastic_ip_id、node_events
增 ip_rotated、provision_idempotency / replacements 表（附加式，不动现网）。

红线：仅面向新厂商池，绝不纳管现网生产 EC2(deploy/ marzban)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/README.md

@@ -0,0 +1,44 @@
+# `infra/` — elastic-node infrastructure
+
+This directory is the **IaC half** of the elastic-node base (task #14). The
+**control-plane half** — vendor adapters and the make-before-break orchestration
+— lives in [`../server/internal/provision`](../server/internal/provision).
+
+```
+infra/
+  terraform/             baseline resources: probe machines + control-plane env
+  cloud-init/
+    node.yaml.tmpl       data-plane node bootstrap (rendered by provision svc)
+  identity-isolation.md  per-asset identity isolation register (doc/06 §2)
+```
+
+## Division of labour (doc/04 §4)
+
+- **Terraform** (`terraform/`) — low-frequency baseline only (probes, control
+  plane). These are in Terraform state.
+- **Provision service** (`server/internal/provision`) — high-frequency,
+  minute-scale, idempotent node open/退机 via vendor APIs. Nodes are cattle and
+  are **never** in Terraform state.
+
+## `cloud-init/node.yaml.tmpl`
+
+The entire persistent footprint of a data-plane node: sing-box + agent + a
+one-time bootstrap token (doc/04 §2). It is a Go `text/template` rendered by the
+provision service's `CloudInitRenderer`, injecting:
+
+`NodeUUID`, `BootstrapToken` (task #5), `Region`, `Role`, `Tier`,
+`ControlPlaneURL`.
+
+The rendered output carries the one-time enrollment token and **must not be
+logged**. The agent self-registers over mTLS (task #6); the control plane then
+drives the node `provisioning → probing → up`.
+
+## Red lines (doc/06 §2)
+
+- Everything here targets the **new vendor pools**. It must **never** manage the
+  production EC2 host (the `deploy/` marzban machine).
+- Credentials are never committed: Terraform tokens via `TF_VAR_*` / CI secrets,
+  vendor API keys via `PROVISION_<VENDOR>_*` env consumed by the provision
+  service. The `providers` table stores only `name/api_kind/regions/pool/enabled`.
+- Each vendor/domain/account is an independent identity with zero cross-linkage;
+  see `identity-isolation.md`.