refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.

clusters/breakpilot-control/README.md

@@ -0,0 +1,47 @@
+# breakpilot-control
+
+Control plane. Single VM (`vm-control`).
+
+Becomes its own Gitea repo `platform/breakpilot-control` at migration time.
+
+## Services (7)
+
+| Service | Purpose |
+|---|---|
+| [`customer-portal.toml`](./services/customer-portal.toml) | Next.js 15 customer-facing portal |
+| [`erpnext.toml`](./services/erpnext.toml) | Internal-only ERP (sales, invoices, fulfillment) |
+| [`frappe-hd.toml`](./services/frappe-hd.toml) | Helpdesk on the Frappe stack |
+| [`mariadb.toml`](./services/mariadb.toml) | DB for ERPNext + Frappe HD |
+| [`redis-erpnext.toml`](./services/redis-erpnext.toml) | ERPNext cache + queue Redis |
+| [`stalwart.toml`](./services/stalwart.toml) | Outbound mail relay; per-stage accept-rule blocks real customers from receiving stage mail |
+| [`tenant-registry.toml`](./services/tenant-registry.toml) | Tenant glue: orgs, entitlements, API keys, audit. M7.3's `TENANT_REGISTRY_URL` resolves here. |
+
+## SLA targets (per `INFRASTRUCTURE.md §6`)
+
+```
+Owns:    RPO (tenant)   — tenant registry & compliance schemas RPO ≤ 6h
+         RPO (ERPNext)  — sales orders, invoices RPO ≤ 6h
+         AUDIT_TRAIL    — all portal actions (invites, IdP changes, impersonations)
+         AVAILABILITY   — portal ≥ 99.5%; ERPNext ≥ 99% (internal)
+         RTO (portal)   — ≤ 10 min
+         RTO (ERPNext)  — ≤ 60 min
+```
+
+## Co-tenant note
+
+ERPNext + Portal + Stalwart on one VM. Orca resource limits per `§6`:
+
+| Service | Memory cap |
+|---|---|
+| customer-portal | 1 GB |
+| erpnext | 6 GB |
+| mariadb | 3 GB |
+| stalwart | 1 GB |
+| tenant-registry | 500 MB |
+
+## Stage callers
+
+Stage workloads in `breakpilot-app/services/stage/` call the **prod**
+tenant-registry here under `tenant.kind = "stage"` rather than running a
+duplicate. Isolation is by tenant kind, not by replicating the control
+plane.

clusters/breakpilot-control/services/customer-portal.toml

@@ -0,0 +1,20 @@
+# customer-portal stub — full config lands in M5.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "customer-portal"
+image = "registry.breakpilot.com/portal:placeholder"
+port = 3000
+domain = "*.breakpilot.com"
+depends_on = ["tenant-registry"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 1.0
+
+[service.env]
+KEYCLOAK_ISSUER = "https://auth.breakpilot.com/realms/breakpilot-prod"
+TENANT_REGISTRY_URL = "http://tenant-registry:8090"

clusters/breakpilot-control/services/erpnext.toml

@@ -0,0 +1,25 @@
+# erpnext stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "erpnext"
+image = "frappe/erpnext:v15"
+port = 8000
+domain = "erp.breakpilot.com"
+depends_on = ["mariadb", "redis-erpnext"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "6Gi"
+cpu = 2.0
+
+[service.volume]
+path = "/home/frappe/frappe-bench/sites"
+
+[service.env]
+DB_HOST = "mariadb"
+REDIS_QUEUE = "redis://redis-erpnext:6379/0"
+REDIS_CACHE = "redis://redis-erpnext:6379/1"
+ADMIN_PASSWORD = "${secrets.ERPNEXT_ADMIN_PASSWORD}"

clusters/breakpilot-control/services/frappe-hd.toml

@@ -0,0 +1,15 @@
+# frappe-hd stub — full config lands in M9.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "frappe-hd"
+image = "frappe/helpdesk:v1"
+port = 8001
+depends_on = ["mariadb", "redis-erpnext"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

clusters/breakpilot-control/services/mariadb.toml

@@ -0,0 +1,20 @@
+# mariadb stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "mariadb"
+image = "mariadb:11"
+port = 3306
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "3Gi"
+cpu = 1.0
+
+[service.volume]
+path = "/var/lib/mysql"
+
+[service.env]
+MARIADB_ROOT_PASSWORD = "${secrets.MARIADB_ROOT_PASSWORD}"

clusters/breakpilot-control/services/redis-erpnext.toml

@@ -0,0 +1,14 @@
+# redis-erpnext stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "redis-erpnext"
+image = "redis:7-alpine"
+port = 6379
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25

clusters/breakpilot-control/services/stalwart.toml

@@ -0,0 +1,22 @@
+# stalwart stub — full config lands in M3.2.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "stalwart"
+image = "stalwartlabs/mail-server:latest"
+port = 587
+domain = "mail.breakpilot.com"
+extra_ports = ["25:25", "465:465", "587:587", "993:993"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.volume]
+path = "/opt/stalwart-mail"
+
+[service.env]
+STALWART__SERVER__HOSTNAME = "mail.breakpilot.com"

clusters/breakpilot-control/services/tenant-registry.toml

@@ -0,0 +1,20 @@
+# tenant-registry stub — full config lands in M4.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "tenant-registry"
+image = "registry.breakpilot.com/tenant-registry:placeholder"
+port = 8090
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.env]
+DATABASE_URL = "${secrets.TENANT_REGISTRY_DB_URL}"
+KEYCLOAK_ISSUER = "https://auth.breakpilot.com/realms/breakpilot-prod"
+KEYCLOAK_ADMIN_USER = "${secrets.KEYCLOAK_ADMIN_USER}"
+KEYCLOAK_ADMIN_PASS = "${secrets.KEYCLOAK_ADMIN_PASS}"