🤖 infra/dev-mesh — the AWS half of the two-node dev mesh

The Dublin (ie) node of the relaxed, cut-off staging fleet. Design + the prod per-country model it rehearses: docs/dev-mesh.md. Its own tofu state (dev-mesh/terraform.tfstate) so it tears down independently of the #550 activator box in infra/dev.

Manages the static skeleton only: the EC2 box + EIP, its security group, the instance role, the shared eleven-dev-mesh-* S3 bucket, the Helsinki node's scoped IAM user, the Route53 dev.11ch.at hosted zone (delegated from the prod 11ch.at DNSimple zone) and its wildcards, and the DNS-01 IAM the boxes use to obtain the shared *.dev.11ch.at cert. The Helsinki (fi) node itself is Hetzner, hand-provisioned like prod's Hetzner boxes.

DNS lives in Route53 now (route53.tf): dev.11ch.at is its own hosted zone in the dev AWS account, NS-delegated from DNSimple (dns.tf). That is the region-neutral base domain for multi-edge Phase 1 — new spaces mint as <sqid>.dev.11ch.at and both boxes obtain the *.dev.11ch.at wildcard cert over Route53 DNS-01 with their AWS role/user, no DNS token on a box (route53dns.go, LCHAT_DNS_PROVIDER=route53). The per-country *.ie.dev / *.fi.dev wildcards moved into this zone too (the delegation makes DNSimple non-authoritative below dev.11ch.at). DNSimple keeps only the dev NS delegation and the home.dev.elevenmessenger.com A record. Cutover + box-reconfig runbook: docs/multi-edge-dev-cutover.md.

# plan (with the AMI-replacement guard) — credentials come from your
# per-operator dev agent item in Bitwarden automatically (AWS_* + DNSIMPLE_*;
# the DNSimple token lives in the Eleven account, 176940):
./deploy/ops dev plan

# apply behind the same guard (tofu's interactive approve remains the gate):
./deploy/ops dev apply

The Helsinki node's scoped S3 secret is a sensitive output — seal it into the vault, never commit it:

AWS_PROFILE=eleven-dev tofu output -raw fi_node_secret_key   # → vault, in your terminal