refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming

Restructures the draft to reflect the 2026-06-30 cluster decision:

Three Orca clusters, each becoming its own Gitea repo at migration time:
- breakpilot-edge   → vm-edge       (Identity + Infra: KC, Gitea, Infisical, PowerDNS, Orca-Proxy)
- breakpilot-control → vm-control   (Portal, tenant-registry, ERPNext, MariaDB, Stalwart)
- breakpilot-app    → vm-app-prod + vm-app-stage (CERTifAI, compliance-*, Mongo, MinIO, Qdrant, LiteLLM)

Key model points encoded:
- Identity (Keycloak) co-tenant with Infra on vm-edge (1 VM core), per
  INFRASTRUCTURE.md §6 — heap pinned so it cannot starve PowerDNS/Infisical
- Stage and prod live in the same breakpilot-app cluster on different
  VMs. Stage authenticates via prod Keycloak under tenant.kind = "stage";
  no duplicated identity, no duplicated control plane (per §5).
- The existing CERTifAI Keycloak will be repurposed for breakpilot-edge
  rather than standing up a fresh one — same realm, same users.
- Multi-VM rollout gated on legal entity being established so we can sign
  SysEleven / Hetzner business contracts. Until then, single-VM ops
  continues via ~/workspace/orca-infra; this repo is design-only.

Mechanical changes:
- manifests/{vm-edge,vm-control,vm-data,stage}/ → clusters/{breakpilot-edge,breakpilot-control,breakpilot-app/services/{prod,stage}}/services/
- vm-data → vm-app-prod, stage → vm-app-stage in node references and headers
- overlays/{stage,prod}/overlay.toml point at the new cluster paths
- scripts/validate.sh now enforces a per-cluster node whitelist
  (breakpilot-edge → vm-edge, breakpilot-control → vm-control,
  breakpilot-app → {vm-app-prod, vm-app-stage}) instead of dir-name equality
- New READMEs at clusters/, clusters/breakpilot-edge/,
  clusters/breakpilot-control/, clusters/breakpilot-app/ documenting
  scope, SLA targets, co-tenant notes, and the future-repo split
- Top README rewritten to lead with the cluster-split decision and the
  legal-entity gate; per-milestone fill-in table re-pathed

Validation:
- make validate → 38 files OK (35 manifests + 3 overlays)
- make plan ENV=stage → 11 resolved manifests in .orca-out/stage/
- make plan ENV=prod  → 24 resolved manifests in .orca-out/prod/

clusters/breakpilot-control/README.md

@@ -0,0 +1,47 @@
+# breakpilot-control
+
+Control plane. Single VM (`vm-control`).
+
+Becomes its own Gitea repo `platform/breakpilot-control` at migration time.
+
+## Services (7)
+
+| Service | Purpose |
+|---|---|
+| [`customer-portal.toml`](./services/customer-portal.toml) | Next.js 15 customer-facing portal |
+| [`erpnext.toml`](./services/erpnext.toml) | Internal-only ERP (sales, invoices, fulfillment) |
+| [`frappe-hd.toml`](./services/frappe-hd.toml) | Helpdesk on the Frappe stack |
+| [`mariadb.toml`](./services/mariadb.toml) | DB for ERPNext + Frappe HD |
+| [`redis-erpnext.toml`](./services/redis-erpnext.toml) | ERPNext cache + queue Redis |
+| [`stalwart.toml`](./services/stalwart.toml) | Outbound mail relay; per-stage accept-rule blocks real customers from receiving stage mail |
+| [`tenant-registry.toml`](./services/tenant-registry.toml) | Tenant glue: orgs, entitlements, API keys, audit. M7.3's `TENANT_REGISTRY_URL` resolves here. |
+
+## SLA targets (per `INFRASTRUCTURE.md §6`)
+
+```
+Owns:    RPO (tenant)   — tenant registry & compliance schemas RPO ≤ 6h
+         RPO (ERPNext)  — sales orders, invoices RPO ≤ 6h
+         AUDIT_TRAIL    — all portal actions (invites, IdP changes, impersonations)
+         AVAILABILITY   — portal ≥ 99.5%; ERPNext ≥ 99% (internal)
+         RTO (portal)   — ≤ 10 min
+         RTO (ERPNext)  — ≤ 60 min
+```
+
+## Co-tenant note
+
+ERPNext + Portal + Stalwart on one VM. Orca resource limits per `§6`:
+
+| Service | Memory cap |
+|---|---|
+| customer-portal | 1 GB |
+| erpnext | 6 GB |
+| mariadb | 3 GB |
+| stalwart | 1 GB |
+| tenant-registry | 500 MB |
+
+## Stage callers
+
+Stage workloads in `breakpilot-app/services/stage/` call the **prod**
+tenant-registry here under `tenant.kind = "stage"` rather than running a
+duplicate. Isolation is by tenant kind, not by replicating the control
+plane.