Terraform bootstrap: remote state and GitHub OIDC #8

Context

None of the infrastructure exists yet. Pixel deploys to Azure with Terraform, and Terraform state must live remotely, not on a laptop. CI and CD (#10) need to authenticate to Azure without long-lived secrets in GitHub.

This is the one-time foundation the environment configs (#9, #12) build on.

Goal

A small, manually applied Terraform "bootstrap" that provides remote state storage and keyless GitHub → Azure authentication.

Scope

• Remote state storage for the environment configs, hardened: versioning or soft delete, no public access, encryption, locking
• GitHub OIDC federation:
  • GitHub Actions in pixelbar/pixel can log in to Azure without stored credentials
  • access is scoped to this repo and its environments
• Least-privilege role assignments for the CI identity
• Documentation: how to apply the bootstrap once, who can, and how to recover

Acceptance criteria

• infra/bootstrap applies cleanly from scratch, and its own small local state is handled and documented
• Environment configs can use the remote backend
• A GitHub Actions job on this repo can authenticate to Azure via OIDC, and other repos can't
• No client secrets are stored in GitHub
• README or runbook explains the bootstrap procedure

Open questions

• Which Azure subscription, and who owns it? This is a blocker.
• Region: probably West Europe (Netherlands) for latency and data residency.
• A naming convention for resources.
• Who in the Pixelbar team should have Owner or Contributor access?

References

• docs/architecture.md: Deployment