terraform: IaC-of-record for the cc-ci Hetzner host (salvaged from PR#2)

The cc-ci server already runs on Hetzner (migration done; nix/hosts/cc-ci-hetzner
landed directly on main 2026-05-31). PR#2's host config was superseded by newer
main commits, but its terraform/ provisioning scaffolding (cpx32 + nixos-infect)
was never preserved. Add it here as the infrastructure-of-record so the box is
reproducible. .gitignore keeps tfstate + secret tfvars out; HCLOUD_TOKEN is an
env var at apply time (no secrets committed). PR#2 closed as superseded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

terraform/versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.0"
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = "1.64.0"
+    }
+  }
+}
+
+# The hcloud provider reads HCLOUD_TOKEN from the environment automatically.
+# Never put the token value in any .tf file or .tfvars — keep it in the shell
+# environment (export HCLOUD_TOKEN=...) or pass via TF_VAR_hcloud_token.
+provider "hcloud" {}