refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.

clusters/breakpilot-app/services/prod/mongodb.toml

@@ -0,0 +1,21 @@
+# mongodb stub — full config lands in M6.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "mongodb"
+image = "mongo:7"
+port = 27017
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "2Gi"
+cpu = 1.0
+
+[service.volume]
+path = "/data/db"
+
+[service.env]
+MONGO_INITDB_ROOT_USERNAME = "${secrets.MONGO_ADMIN_USER}"
+MONGO_INITDB_ROOT_PASSWORD = "${secrets.MONGO_ADMIN_PASSWORD}"