feat(all): introduce partition/region/ceph-cluster model across the stack (#222)

* feat: introduce partition/region/ceph-cluster model across the stack

Formalize partition -> region -> {one k8s cluster, many ceph clusters} and
thread it through every layer plus a new yuctl ops CLI.

- tf: deployment/<partition>/<region>/<stack> layout; terragrunt path-parse +
  state key yucca/<partition>/<region>/<stack>; per-region region.hcl (role,
  site_id, datacenter, provider_code, domain); env->partition / site->region
  renames (NetBird object names byte-identical); standardized per-stack
  `discovery` output contract (secrets as op:// refs).
- k8s: clusters/<partition>/<region>/ (staging/austin, prod/htz-fsn1, dev/local);
  role-based kustomize components (primary/secondary); hybrid cluster-settings
  (TF-rendered identity + human fragment); dev-mirror folded into dev/local;
  charts regrouped into charts/{apps,platform,lib,dev}.
- ci: infra.yml partition/region discovery matrix; partition-keyed path filters;
  <partition>-<region> environment gates; image-versions path moves.
- ansible: inventories under <partition>-<region>/<cluster>.
- yuctl: Go/cobra CLI reading the discovery contract from TF state.
- Retire the sietch-talos libvirt VM cluster (dev@local is the k3d cluster);
  ceph inventory_dirname -> <partition>-<region>/<cluster>.

Verified: mise k8s:validate green (3 clusters); yuctl go build/vet; tofu
validate pre-merge (all 9 stacks). Live-staging state migration NOT run.

* fix typo

* commit

.gitignore

@@ -1,6 +1,9 @@
 node_modules
 *.tsbuildinfo
 
+# Claude Code local state — per-operator settings + agent worktrees; never commit.
+.claude/
+
 .env.local
 .env
 
@@ -50,6 +53,9 @@ ansible/*/.ansible/
 ansible/*/.ansible_facts_cache/
 ansible/*/.venv/
 
+# Working notes for the partition/region/ceph-cluster rework — local scratch.
+notes.md
+
 # Lens / decision-support artifacts are controller-local notes, not repo code.
 # Per-project: kept outside the repo (e.g., ~/Projects/immich/yucca-ceph-import/analysis/
 # on operator workstation, but not tracked).