refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.

clusters/breakpilot-control/services/stalwart.toml

@@ -0,0 +1,22 @@
+# stalwart stub — full config lands in M3.2.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "stalwart"
+image = "stalwartlabs/mail-server:latest"
+port = 587
+domain = "mail.breakpilot.com"
+extra_ports = ["25:25", "465:465", "587:587", "993:993"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.volume]
+path = "/opt/stalwart-mail"
+
+[service.env]
+STALWART__SERVER__HOSTNAME = "mail.breakpilot.com"