terraform+nix: Hetzner orchestrator server (cpx11, nixos-infect, cc-ci-orchestrator-hetzner flake host)

Adds terraform/ to provision a Hetzner cpx11 (2 vCPU / 2 GB dedicated AMD / 40 GB NVMe)
for the loops runtime, and a flake + NixOS host config to converge it — replacing the slow
b1 Incus VM. Mirrors the cc-ci server terraform (same nixos-infect pin, same pattern).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

terraform/main.tf

@@ -0,0 +1,32 @@
+resource "hcloud_ssh_key" "cc_ci_orch" {
+  name       = "cc-ci-orchestrator-deploy"
+  public_key = var.ssh_public_key
+
+  labels = {
+    project = "cc-ci-orchestrator"
+    managed = "terraform"
+  }
+}
+
+resource "hcloud_server" "cc_ci_orch" {
+  name        = var.server_name
+  server_type = var.server_type
+  image       = var.image
+  location    = var.location
+  ssh_keys    = [hcloud_ssh_key.cc_ci_orch.id]
+
+  # Stage 1: cloud-init runs nixos-infect on first boot, converting Debian to NixOS, then reboots.
+  # Wait ~5 min after apply, then SSH in and run Stage 2 per README.md.
+  user_data = file("${path.module}/user-data.sh")
+
+  public_net {
+    ipv4_enabled = true
+    ipv6_enabled = false
+  }
+
+  labels = {
+    project = "cc-ci-orchestrator"
+    managed = "terraform"
+    stage   = "infect"
+  }
+}