chore: scaffold repository layout

Directory skeleton from PLAN.md, plus a .gitignore that blocks .env files,
kubeconfigs, terraform state and sealed-secrets key backups. Empty directories
are held by .gitkeep so the layout survives a clone.

.gitignore

@@ -0,0 +1,22 @@
+# Secrets and credentials. Nothing here ever reaches the repo.
+.env
+.env.*
+!.env.example
+*.kubeconfig
+kubeconfig
+*sealed-secrets-key*.yaml
+
+# Terraform. Lock file is committed on purpose, state never is.
+.terraform/
+*.tfstate
+*.tfstate.*
+*.tfvars
+!*.tfvars.example
+crash.log
+
+# Build output
+bin/
+dist/
+node_modules/
+
+.DS_Store