feat(opentofu): cut tfstate backend over to Garage

Phase 4 of the migration off RustFS. State file was copied + sha256
verified by pipeline 793. Switch:

- providers.tf backend "s3": endpoint http://s3.renner.uno:9000 →
  https://s3.nas-1.renner.uno, region main → garage.
- deploy-infrastructure.yml (validate-secrets / plan / apply) and
  rebuild-k8s.yml (recreate-vms): tf_rfs_access/tf_rfs_secret →
  tf_garage_access/tf_garage_secret.

The aws provider block in providers.tf still points at RustFS — that
manages aws_s3_bucket.caddy_certificates which lives on RustFS, and
migrating that bucket is a separate concern.

This push will auto-trigger deploy-infrastructure plan against Garage;
expected to produce the same plan output as pipeline 787 (cleanup-only
baseline) plus the still-unfixed 8-resource provider misread, since
the actual rm+import payload couldn't persist last time and needs to
be re-run with a writable backend.

.woodpecker/deploy-infrastructure.yml

@@ -13,11 +13,11 @@ steps:
       TF_VAR_proxmox_api_url:
         from_secret: proxmox_api_url
       AWS_ACCESS_KEY_ID:
-        from_secret: tf_rfs_access
+        from_secret: tf_garage_access
     commands:
       - |
         if [ -z "$TF_VAR_proxmox_api_url" ]; then echo "Missing proxmox_api_url secret"; exit 1; fi
-        if [ -z "$AWS_ACCESS_KEY_ID" ]; then echo "Missing tf_rfs_access secret"; exit 1; fi
+        if [ -z "$AWS_ACCESS_KEY_ID" ]; then echo "Missing tf_garage_access secret"; exit 1; fi
         echo "Secrets validated"
 
   - name: plan
@@ -34,9 +34,9 @@ steps:
       TF_VAR_proxmox_token_secret:
         from_secret: proxmox_token_secret
       AWS_ACCESS_KEY_ID:
-        from_secret: tf_rfs_access
+        from_secret: tf_garage_access
       AWS_SECRET_ACCESS_KEY:
-        from_secret: tf_rfs_secret
+        from_secret: tf_garage_secret
       AWS_REGION: "us-east-1"
       TF_VAR_unifi_api_key:
         from_secret: unifi_api_key
@@ -86,9 +86,9 @@ steps:
       TF_VAR_proxmox_token_secret:
         from_secret: proxmox_token_secret
       AWS_ACCESS_KEY_ID:
-        from_secret: tf_rfs_access
+        from_secret: tf_garage_access
       AWS_SECRET_ACCESS_KEY:
-        from_secret: tf_rfs_secret
+        from_secret: tf_garage_secret
       AWS_REGION: "us-east-1"
       TF_VAR_unifi_api_key:
         from_secret: unifi_api_key

.woodpecker/rebuild-k8s.yml

@@ -17,9 +17,9 @@ steps:
       TF_VAR_proxmox_token_secret:
         from_secret: proxmox_token_secret
       AWS_ACCESS_KEY_ID:
-        from_secret: tf_rfs_access
+        from_secret: tf_garage_access
       AWS_SECRET_ACCESS_KEY:
-        from_secret: tf_rfs_secret
+        from_secret: tf_garage_secret
       AWS_REGION: "us-east-1"
       TF_VAR_unifi_api_key:
         from_secret: unifi_api_key

opentofu/providers.tf

@@ -2,8 +2,8 @@ terraform {
   backend "s3" {
     bucket                      = "tfstate"
     key                         = "terraform.tfstate"
-    region                      = "main"
-    endpoint                    = "http://s3.renner.uno:9000"
+    region                      = "garage"
+    endpoint                    = "https://s3.nas-1.renner.uno"
     skip_credentials_validation = true
     skip_requesting_account_id  = true
     skip_metadata_api_check     = true