Terraform changes reviewable in the pull request

Plan and apply move into the pull request: reviewers read the actual terraform plan output, approval gates the apply, and state stays consistent.

Infrastructure changes become reviewable instead of “run plan locally and hope”.