refactor: decouple monolithic Terraform aws-resource-creation into independent layered components

[bhumi46]

Problem

The current `aws-main.tf` chains all AWS resource creation into a single tightly-coupled module — EC2, EBS, Security Groups, Route53, RKE2, Rancher import, NFS, PostgreSQL, and ActiveMQ all share one Terraform state and one sequential `depends_on` chain.

This means:

• Adding a DNS subdomain requires Terraform to evaluate all EC2 and SG state — risky
• EBS volumes are inline `ebs_block_device` blocks inside `aws_instance` — can't resize or add volumes without touching the instance resource
• Security groups for all 4 node types (nginx, control-plane, etcd, worker) are one combined variable blob — can't update independently
• RKE2 and Rancher import are in the same module — can't re-run import without re-running RKE2 setup
• No isolation between DNS, compute, cluster, and setup layers

Proposed Solution

Decouple into 3 layers, each with its own Terraform root and state file:

```
Layer 1 — Networking (rarely changes)
└── security-groups

Layer 2 — Compute (changes when scaling)
├── ec2
├── ebs
└── dns

Layer 3 — Cluster setup (runs after compute)
├── nginx
├── rke2
├── rancher-import
├── nfs
├── postgresql
└── activemq
```

Each component has its own state file (GPG-encrypted, committed to git). Components discover dependencies via AWS data sources (tag-based lookup) rather than state sharing.

Sub-tasks

• refactor(terraform): decouple Security Groups into own Terraform root — Layer 1 #274 — Decouple Security Groups into own root (Layer 1)
• refactor(terraform): decouple EC2 instances into own Terraform root — Layer 2 #275 — Decouple EC2 instances into own root (Layer 2)
• refactor(terraform): decouple EBS volumes from EC2 instance resource — Layer 2 #276 — Decouple EBS volumes from EC2 (Layer 2)
• refactor(terraform): decouple Route53 DNS records into own Terraform root — Layer 2 #277 — Decouple Route53 DNS into own root (Layer 2)
• refactor(terraform): decouple nginx + certbot setup into own Terraform root — Layer 3 #278 — Decouple nginx + certbot into own root (Layer 3)
• refactor(terraform): decouple RKE2 cluster setup into own Terraform root — Layer 3 #279 — Decouple RKE2 cluster setup into own root (Layer 3)
• refactor(terraform): decouple Rancher import as standalone re-runnable component — Layer 3 #280 — Decouple Rancher import as standalone re-runnable component (Layer 3)
• refactor(terraform): decouple NFS, PostgreSQL, ActiveMQ setup into own Terraform roots — Layer 3 #281 — Decouple NFS, PostgreSQL, ActiveMQ setup into own roots (Layer 3)
• refactor(terraform): update GitHub Actions terraform.yml with new decoupled component inputs #282 — Update GitHub Actions terraform.yml with new component inputs