[ftgonc]

Summary

Adds OCI Object Storage as a remote backend for state import, so oxid init and oxid sync work for configurations using Terraform's backend "oci" (Terraform 1.12+). Today it falls through to BackendConfig::Unsupported and users must terraform state pull by hand.

• New BackendConfig::Oci variant, parsed from the same attributes as Terraform's backend: bucket, namespace, key (defaults to terraform.tfstate), region, tenancy_ocid, user_ocid, fingerprint, private_key_path, config_file_profile, auth
• New src/state/oci.rs: fetches the state object with OCI HTTP signature auth (RSA-SHA256 over date, (request-target), host), no OCI SDK dependency
• Credentials come from the backend block first, then the OCI CLI config file (~/.oci/config or OCI_CLI_CONFIG_FILE), profile DEFAULT unless config_file_profile is set, with missing keys inherited from DEFAULT, as the OCI SDKs do
• Accepts PKCS#8 and PKCS#1 keys, including keys downloaded from the OCI console, which end with an OCI_API_KEY marker line after the PEM block
• Gated behind a new default feature oci-backend (adds rsa and base64); without it, a clear "not compiled in" error, mirroring s3-backend
• Small refactor: BackendConfig::location() gives a display string, so init, sync and import print the S3 and OCI cases through one path instead of per-backend match arms. S3 output wording changes slightly (Detected Terraform backend: s3://bucket/key (region: …))

Out of scope

• Writing or locking remote state: read-only, matching the existing S3 support
• Instance principal, resource principal and session-token auth: these return an explicit error pointing to --state-file
• Passphrase-protected keys: these return an explicit error asking for an unencrypted API key
• workspace_key_prefix for non-default Terraform workspaces

Test plan

• Unit tests in state::oci: config file sections, backend attributes overriding the profile, missing-credential error, object path encoding (/ in object names → %2F), PEM extraction with the console marker, key parsing, and a signature round-trip verified against the public key
• test_oci_backend_block_parsed and test_oci_backend_key_defaults_to_terraform_tfstate
• Full test suite passes (135 tests, 0 failures)
• Builds with --no-default-features --features sqlite,s3-backend
• cargo fmt --all -- --check clean
• cargo clippy --all-targets -- -D warnings: no new findings. Current stable clippy reports 33 pre-existing double_must_use errors in src/state/backend.rs on main as well, untouched here
• Manually against a real OCI tenancy: oxid init and oxid sync on a config with backend "oci" and a console-generated API key imported the same resources as terraform state pull

[chaitanya-sistla]

@ftgonc approved workflows