refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.

clusters/breakpilot-edge/README.md

@@ -0,0 +1,42 @@
+# breakpilot-edge
+
+Identity + Infra plane. Single VM (`vm-edge`).
+
+Becomes its own Gitea repo `platform/breakpilot-edge` at migration time.
+
+## Services (8)
+
+| Service | Purpose |
+|---|---|
+| [`gitea.toml`](./services/gitea.toml) | Source forge — every config change to every cluster lands here |
+| [`infisical.toml`](./services/infisical.toml) | Secret store. Every other plane's `${secrets.*}` resolves here |
+| [`keycloak.toml`](./services/keycloak.toml) | Single tenant of truth for identity. **Repurposed from `certifai` Keycloak — same realm, same users**. |
+| [`orca-proxy.toml`](./services/orca-proxy.toml) | Ingress for vm-edge: TLS termination + Let's Encrypt ACME for `*.breakpilot.com` |
+| [`pg-infisical.toml`](./services/pg-infisical.toml) | Infisical's Postgres |
+| [`pg-keycloak.toml`](./services/pg-keycloak.toml) | Keycloak's Postgres |
+| [`powerdns-auth.toml`](./services/powerdns-auth.toml) | Authoritative DNS for `breakpilot.com`; bound to port 53 on vm-edge |
+| [`redis-infisical.toml`](./services/redis-infisical.toml) | Cache + session store for Infisical |
+
+## SLA targets (per `INFRASTRUCTURE.md §6`)
+
+```
+Owns:    AVAILABILITY ≥ 99.5% (root dep for every other plane)
+         RTO ≤ 15 min (Keycloak)
+         AUDIT_TRAIL — realm-level audit (logins, token issuance, IdP events)
+         DATA_RESIDENCY — Keycloak realm data must stay EU
+         STAGE_ISOLATION — rate-limits stage_client_id; rejects stage JWTs in prod audiences
+```
+
+## Co-tenant note
+
+Keycloak's JVM heap is pinned to 1.5 GB in `keycloak.toml`
+(`JAVA_OPTS_APPEND = "-Xms1g -Xmx1500m"`) so it cannot starve PowerDNS or
+Infisical. If the heap fight ever shows up in alerts, the escape hatch is
+to peel Keycloak off onto its own VM inside the same cluster — no schema
+migration, just a `placement.node` flip.
+
+## Bootstrap exception
+
+Per `INFRASTRUCTURE.md §8 rule 3`, `KC_DB_URL` lives in Orca env (not in
+Infisical), because Infisical runs on the same VM and we'd otherwise have
+a circular bootstrap dependency.

clusters/breakpilot-edge/services/gitea.toml

@@ -0,0 +1,25 @@
+# gitea stub — full config lands in M3.x.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "gitea"
+image = "gitea/gitea:1.22"
+port = 3000
+domain = "git.breakpilot.com"
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.volume]
+path = "/data"
+
+[service.env]
+USER_UID = "1000"
+USER_GID = "1000"
+GITEA__database__DB_TYPE = "sqlite3"
+GITEA__database__PATH = "/data/gitea/gitea.db"
+GITEA__server__ROOT_URL = "https://git.breakpilot.com"

clusters/breakpilot-edge/services/infisical.toml

@@ -0,0 +1,22 @@
+# infisical stub — full config lands in M3.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "infisical"
+image = "infisical/infisical:latest"
+port = 8080
+depends_on = ["pg-infisical", "redis-infisical"]
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.env]
+DB_CONNECTION_URI = "${secrets.INFISICAL_DB_URI}"
+REDIS_URL = "redis://redis-infisical:6379"
+ENCRYPTION_KEY = "${secrets.INFISICAL_ENCRYPTION_KEY}"
+AUTH_SECRET = "${secrets.INFISICAL_AUTH_SECRET}"
+SITE_URL = "https://infisical.breakpilot.com"

clusters/breakpilot-edge/services/keycloak.toml

@@ -0,0 +1,25 @@
+# keycloak stub — full config lands in M2.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Bootstrap exception per §8 rule 3: KC_DB_URL lives in Orca env, not Infisical (Infisical runs on same VM).
+
+[[service]]
+name = "keycloak"
+image = "quay.io/keycloak/keycloak:26.0"
+port = 8443
+domain = "auth.breakpilot.com"
+depends_on = ["pg-keycloak"]
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "2Gi"
+cpu = 1.0
+
+[service.env]
+KC_DB = "postgres"
+KC_DB_URL = "${secrets.KC_DB_URL}"
+KC_HOSTNAME = "auth.breakpilot.com"
+KC_PROXY_HEADERS = "xforwarded"
+KC_HEALTH_ENABLED = "true"
+JAVA_OPTS_APPEND = "-Xms1g -Xmx1500m"

clusters/breakpilot-edge/services/orca-proxy.toml

@@ -0,0 +1,15 @@
+# orca-proxy stub — full config lands in M1.2/M0.3.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Wildcard TLS terminator; routing rules land with M0.3.
+
+[[service]]
+name = "orca-proxy"
+image = "orca-managed/orca-proxy:placeholder"
+port = 443
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.5

clusters/breakpilot-edge/services/pg-infisical.toml

@@ -0,0 +1,22 @@
+# pg-infisical stub — full config lands in M3.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "pg-infisical"
+image = "postgres:16-alpine"
+port = 5432
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25
+
+[service.volume]
+path = "/var/lib/postgresql/data"
+
+[service.env]
+POSTGRES_DB = "infisical"
+POSTGRES_USER = "infisical"
+POSTGRES_PASSWORD = "${secrets.PG_INFISICAL_PASSWORD}"

clusters/breakpilot-edge/services/pg-keycloak.toml

@@ -0,0 +1,22 @@
+# pg-keycloak stub — full config lands in M2.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "pg-keycloak"
+image = "postgres:16-alpine"
+port = 5432
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.volume]
+path = "/var/lib/postgresql/data"
+
+[service.env]
+POSTGRES_DB = "keycloak"
+POSTGRES_USER = "keycloak"
+POSTGRES_PASSWORD = "${secrets.PG_KEYCLOAK_PASSWORD}"

clusters/breakpilot-edge/services/powerdns-auth.toml

@@ -0,0 +1,15 @@
+# powerdns-auth stub — full config lands in M0.3.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "powerdns-auth"
+image = "powerdns/pdns-auth:4.9"
+port = 53
+extra_ports = ["53:53/udp", "53:53/tcp"]
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25

clusters/breakpilot-edge/services/redis-infisical.toml

@@ -0,0 +1,15 @@
+# redis-infisical stub — full config lands in M3.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Ephemeral cache; no volume.
+
+[[service]]
+name = "redis-infisical"
+image = "redis:7-alpine"
+port = 6379
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "128Mi"
+cpu = 0.1