chore: initialize k3s master iac skeleton

terraform/main.tf

@@ -0,0 +1,11 @@
+provider "vsphere" {
+  user           = var.vsphere_user
+  password       = var.vsphere_password
+  vsphere_server = var.vsphere_server
+
+  # CI pipeline injects sensitive certificates and ignores insecure SSL via TF vars if required.
+  allow_unverified_ssl = false
+}
+
+# Placeholder resource block intentionally omitted.
+# Actual VM cloning, tagging, and network configuration will be added in follow-up stories.