Add aws-ec2-vault-cluster connections, IAM, and security groups

[amitslog]

First slice of the Nullstone AWS module. A workspace can connect VPC, snapshot S3, and unseal KMS. IAM, Secrets Manager token slots, and node/NLB security groups are in. ASG, NLB, launch template, and user-data are not.

PR Summary

• New module aws-ec2-vault-cluster under aws/aws-ec2-vault-cluster/.
• Connections:
  • network (network/aws/vpc)
  • snapshots_bucket (datastore/aws/s3) for Raft snapshots under vault-snapshots/
  • unseal_key (datastore/aws/kms), separate from optional bucket SSE
• Instance role: unseal KMS, optional snapshot KMS, S3 get/put on the snapshot prefix, Secrets Manager get/put on the three Terraform-created ARNs, ec2:DescribeInstances, SSM.
• Secrets Manager secrets for init, provisioning, and operator (empty until bootstrap writes them).
• Security groups for nodes and the future internal NLB (8200 API, 8201 Raft, 8210 vault-utils health).
• Knobs: cluster_size (odd: 1, 3, 5, 7, ...), instance_type, backup_schedule (cron, empty disables). Unused until ASG exists.

Follow-up on this branch: vault-utils health on 8210, user-data/AMI, NLB, then ASG.

How I validated

From aws/aws-ec2-vault-cluster/:

tofu fmt -check
tofu init -backend=false
tofu validate

All three succeeded.

tofu plan was run without a Nullstone workspace or AWS credentials. It failed with no nullstone workspace 0/0/0 and missing AWS credentials. That is expected. There is no live Nullstone preview against real connections yet. go test does not cover aws/. tofu apply was not run.

R1 Note

Addressed review: module moved to aws/aws-ec2-vault-cluster/, renamed aws-ec2-vault-cluster, connection snapshots_bucket, odd cluster_size, cron backup_schedule, CHANGELOG cleared. tofu fmt / validate passed. go test -short ./... and isolation tests passed.

[BSick7]

Great start! I left some comments.
Can you also move this module under ./aws/aws-ec2-vault-cluster/ in the event we add a k8s implementation?

[amitslog]

R1 applied in f0110b7. Same changes as the suggestions (module path/name, snapshots_bucket, odd cluster_size, cron backup_schedule, CHANGELOG). Resolving the review threads.