feat(iac): scaffold orca-platform layout (M1.1)

Lands the per-VM × per-service manifest tree, per-env overlays, VM specs
for SysEleven provisioning, DNS zone placeholder, plan/apply/validate
scripts, and a Makefile.

Structure (per INFRASTRUCTURE.md §2 + IMPLEMENTATION_PLAN.md M1.1):
- manifests/{vm-edge,vm-control,vm-data,stage}/<service>.toml — 35 stubs
- overlays/{dev,stage,prod}/overlay.toml — env-selection rules
- vms/{vm-edge,vm-control,vm-data,stage}.toml — OpenStack flavor/IP/firewall
- dns/yourplatform.com.zone.template — PowerDNS zone (body lands in M0.3)
- cluster.toml.tmpl — cluster-level config rendered per env
- scripts/validate.sh — TOML parse + structural sanity
- scripts/plan.sh — merge manifests + overlay → .orca-out/<env>/
- scripts/apply.sh — push to Orca controller (no-op until M1.2)
- Makefile — validate / plan / apply / diff / clean

Each manifest header names the milestone that finalises its real values;
images today are 'placeholder' for services that need their own repo to
exist first. make validate stays green; apply gates on ORCA_API_URL.

CI workflow swapped from the broken 'orca validate' to 'make validate',
which calls a Python TOML parser plus structural checks (placement.node
matches vm dir, resources.memory present, no mis-nested keys).

Refs: M1.1

manifests/vm-control/customer-portal.toml

@@ -0,0 +1,20 @@
+# customer-portal stub — full config lands in M5.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "customer-portal"
+image = "registry.yourplatform.com/portal:placeholder"
+port = 3000
+domain = "*.yourplatform.com"
+depends_on = ["tenant-registry"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 1.0
+
+[service.env]
+KEYCLOAK_ISSUER = "https://auth.yourplatform.com/realms/breakpilot-prod"
+TENANT_REGISTRY_URL = "http://tenant-registry:8080"

manifests/vm-control/erpnext.toml

@@ -0,0 +1,25 @@
+# erpnext stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "erpnext"
+image = "frappe/erpnext:v15"
+port = 8000
+domain = "erp.yourplatform.com"
+depends_on = ["mariadb", "redis-erpnext"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "6Gi"
+cpu = 2.0
+
+[service.volume]
+path = "/home/frappe/frappe-bench/sites"
+
+[service.env]
+DB_HOST = "mariadb"
+REDIS_QUEUE = "redis://redis-erpnext:6379/0"
+REDIS_CACHE = "redis://redis-erpnext:6379/1"
+ADMIN_PASSWORD = "${secrets.ERPNEXT_ADMIN_PASSWORD}"

manifests/vm-control/frappe-hd.toml

@@ -0,0 +1,15 @@
+# frappe-hd stub — full config lands in M9.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "frappe-hd"
+image = "frappe/helpdesk:v1"
+port = 8001
+depends_on = ["mariadb", "redis-erpnext"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

manifests/vm-control/mariadb.toml

@@ -0,0 +1,20 @@
+# mariadb stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "mariadb"
+image = "mariadb:11"
+port = 3306
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "3Gi"
+cpu = 1.0
+
+[service.volume]
+path = "/var/lib/mysql"
+
+[service.env]
+MARIADB_ROOT_PASSWORD = "${secrets.MARIADB_ROOT_PASSWORD}"

manifests/vm-control/redis-erpnext.toml

@@ -0,0 +1,14 @@
+# redis-erpnext stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "redis-erpnext"
+image = "redis:7-alpine"
+port = 6379
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25

manifests/vm-control/stalwart.toml

@@ -0,0 +1,22 @@
+# stalwart stub — full config lands in M3.2.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "stalwart"
+image = "stalwartlabs/mail-server:latest"
+port = 587
+domain = "mail.yourplatform.com"
+extra_ports = ["25:25", "465:465", "587:587", "993:993"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.volume]
+path = "/opt/stalwart-mail"
+
+[service.env]
+STALWART__SERVER__HOSTNAME = "mail.yourplatform.com"

manifests/vm-control/tenant-registry.toml

@@ -0,0 +1,20 @@
+# tenant-registry stub — full config lands in M4.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "tenant-registry"
+image = "registry.yourplatform.com/tenant-registry:placeholder"
+port = 8080
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.env]
+DATABASE_URL = "${secrets.TENANT_REGISTRY_DB_URL}"
+KEYCLOAK_ISSUER = "https://auth.yourplatform.com/realms/breakpilot-prod"
+KEYCLOAK_ADMIN_USER = "${secrets.KEYCLOAK_ADMIN_USER}"
+KEYCLOAK_ADMIN_PASS = "${secrets.KEYCLOAK_ADMIN_PASS}"