feat(iac): scaffold orca-platform layout (M1.1)

Lands manifests/, overlays/, dns/, scripts/, Makefile per M1.1. Bundles yourplatform.com→breakpilot.com rename. vms/ removed (out-of-scope for Orca).

Refs: M1.1

cluster.toml.tmpl

@@ -0,0 +1,29 @@
+# Cluster-level config rendered per env.
+# Real values get substituted by `make plan ENV=<env>` from environment +
+# overlays/<env>/overlay.toml.
+#
+# Schema mirrors ~/workspace/orca-infra/cluster.toml (Orca-native).
+
+[cluster]
+name = "breakpilot-${ENV}"
+domain = "${DOMAIN}"
+acme_email = "oncall@breakpilot.com"
+
+[ai]
+provider = "litellm"
+endpoint = "https://llm.breakpilot.com"
+model = "gpt-oss-120b"
+api_key = "${secrets.LITELLM_API_KEY}"
+
+[backup]
+enabled = true
+schedule = "0 0 3 * * *"
+retention_days = 30
+
+[[backup.targets]]
+type = "s3"
+endpoint = "https://s3.dus2.cloud.syseleven.net"
+bucket = "platform-${ENV}-backups"
+region = "dus2"
+access_key = "${secrets.S3_ACCESS_KEY}"
+secret_key = "${secrets.S3_SECRET_KEY}"