chore: Clean up Terraform/Tofu artifacts and improve .gitignore

Remove accidentally committed tfplan file and obsolete backup files
from the tofu/ directory.

Changes:
- Remove tofu/tfplan from repository (binary plan file, should not be tracked)
- Delete terraform.tfvars.bak (old private network config, no longer needed)
- Delete terraform.tfstate.1768302414.backup (outdated state from Jan 13)
- Update .gitignore to prevent future commits of:
  - tfplan files (tofu/tfplan, tofu/*.tfplan)
  - Numbered state backups (tofu/terraform.tfstate.*.backup)

Security Assessment:
- tfplan contained infrastructure state (server IPs) but no credentials
- No sensitive tokens or passwords were exposed
- All actual secrets remain in SOPS-encrypted files only

The tfplan was only in commit b6c9fa6 (post-workshop state) and is now
removed going forward.

🤖 Generated with Claude Code (https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -12,8 +12,11 @@ tofu/.terraform/
 tofu/.terraform.lock.hcl
 tofu/terraform.tfstate
 tofu/terraform.tfstate.backup
+tofu/terraform.tfstate.*.backup
 tofu/*.tfvars
 !tofu/terraform.tfvars.example
+tofu/*.tfplan
+tofu/tfplan
 
 # Ansible
 ansible/*.retry