terraform: never replace a running server

hcloud replaces a server when user_data, image or ssh_keys change, and
cloud-init only runs at first boot anyway. An edit to cloud-init, like
adding a user, would therefore plan the destruction of a production
machine. Ignore changes to those three attributes and set
prevent_destroy on both servers, so cloud-init describes a rebuild and
nothing else.

Add user zerrtika to cloud-init to match the servers; the user was
created on them by playbook 04.

Assisted-by: Claude:fable-5-2

terraform/README.md

@@ -4,8 +4,14 @@ Hetzner Cloud infrastructure managed via Terraform.
 
 ## Servers
 
-- **asxpio-ops** (CX22: 2 vCPU, 4GB) - Forgejo, Traefik, monitoring, static sites
-- **asxpio-services** (CX43: 8 vCPU, 16GB) - Immich, game servers, XMPP, CI/CD
+- **asxpio-ops** (2 vCPU, 4GB) - Traefik, Forgejo, app stacks
+- **asxpio-services** (CX43: 8 vCPU, 16GB) - CI runner, game servers, SillyTavern
+
+Both servers carry `prevent_destroy` and ignore changes to `user_data`,
+`image` and `ssh_keys`: cloud-init only runs at first boot, and hcloud
+would otherwise replace a running server when those change. Edits to
+`cloud-init/*.yaml` therefore describe a rebuild, not the live machine;
+day-to-day configuration is in `../ansible`.
 
 ## Storage (S3-compatible)
 
@@ -17,7 +23,7 @@ Hetzner Cloud infrastructure managed via Terraform.
 - asxpio-backups-main (hel1)
 - asxpio-backups-repl (fsn1)
 
-**Immich:**
+**Immich (buckets kept, service not running):**
 - asxpio-immich-main (hel1)
 - asxpio-immich-repl (fsn1)
 
@@ -31,7 +37,7 @@ Hetzner Cloud infrastructure managed via Terraform.
 
 | Item | Monthly |
 |------|---------|
-| ops CX22 | €3.71 |
+| ops | €3.71 |
 | services CX43 | €11.15 |
 | IPv4 (2x) | €1.24 |
 | S3 (1TB) | €6.19 |