feat(provision): 弹性节点基建 Terraform + 一键更换 (tsk_6u0FxmbC7Yeq)

IaC 面 (infra/) 与控制面 (server/internal/provision) 双产出，落地 doc/04 §4
「节点是牲口」弹性拓扑与 make-before-break 一键更换。

server/internal/provision:
- CloudAdapter 适配层 + Registry（首发 vultr 消耗品池 / hetzner 精品池各一）；
  厂商凭证仅从 PROVISION_<VENDOR>_* env 注入，不入库不入 git。
- ProvisionService：CreateNode(幂等键重放不重复开机)、DestroyNode(幂等)、
  RotateIP(换 IP 不换机 + version bump)、ListProviders。
- Replace 一键更换：先建后拆，新机 up 先于旧机 draining（容量不下降），
  replacement_uuid 幂等键 + replacements 表分步记录，崩溃可续跑不重复。
- RotatePool：池内滚动轮换，并发度 1–2。
- cmd/nodectl CLI：create/destroy/rotate-ip/replace/rotate-pool/providers。
- 单测（mock 厂商 API + 内存 Store）：幂等重放、make-before-break 时序断言、
  开机失败/探活超时→destroyed+失败计数+告警钩子、崩溃续跑、RotatePool。

infra/:
- terraform/：探针机 + 控制面基线模块化（probe / control-plane）+ README，
  低频基线进 state，节点不进 Terraform。
- cloud-init/node.yaml.tmpl：节点引导模板（注入一次性 bootstrap token，task #5）。
- identity-isolation.md：身份隔离登记表（doc/06 §2 红线，无任何凭证）。

migrations/000008：nodes 增 provider_instance_id/elastic_ip_id、node_events
增 ip_rotated、provision_idempotency / replacements 表（附加式，不动现网）。

红线：仅面向新厂商池，绝不纳管现网生产 EC2(deploy/ marzban)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/terraform/modules/probe/main.tf

@@ -0,0 +1,57 @@
+terraform {
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.45"
+    }
+  }
+}
+
+# One overseas reference probe point (doc/04 §4.2). It runs the probe script and
+# reports TCP/TLS/real-handshake reachability of data-plane nodes back to the
+# control plane, used to distinguish "blocked" from "machine down".
+resource "hcloud_server" "probe" {
+  name        = "pangolin-probe-${var.name}"
+  server_type = var.server_type
+  image       = var.image
+  location    = var.location
+  ssh_keys    = var.ssh_key_ids
+
+  labels = {
+    role    = "probe"
+    project = "pangolin"
+    scope   = "overseas-reference"
+  }
+
+  # Probe bootstrap: pin + install the probe agent out-of-band. Kept minimal;
+  # probes hold NO data-plane secrets and NO user data.
+  user_data = <<-EOT
+    #cloud-config
+    package_update: true
+    runcmd:
+      - sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+      - sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+      - systemctl restart sshd || true
+  EOT
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# Firewall: probes only need outbound; lock inbound to SSH from management.
+resource "hcloud_firewall" "probe" {
+  name = "pangolin-probe-${var.name}"
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = length(var.ssh_allowlist_cidrs) > 0 ? var.ssh_allowlist_cidrs : ["0.0.0.0/0", "::/0"]
+  }
+}
+
+resource "hcloud_firewall_attachment" "probe" {
+  firewall_id = hcloud_firewall.probe.id
+  server_ids  = [hcloud_server.probe.id]
+}