feat: Added remote state storage in S3 bucket

infra/backend.hcl.example

@@ -0,0 +1,34 @@
+# Copy to backend.hcl and fill in - backend.hcl itself is gitignored, never
+# commit real values there. Used as `tofu init -backend-config=backend.hcl`
+# (control.sh's OpenTofu > init does this for you).
+#
+# This is the *same* S3-compatible bucket already used for service backups
+# (BACKUP_S3_BUCKET/BACKUP_S3_ENDPOINT in control.sh > Set variables) - just a
+# different object key so state never collides with backup archives.
+# Credentials are NOT set here: the s3 backend picks up the standard
+# AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY environment variables, which
+# control.sh exports from BACKUP_S3_ACCESS_KEY_ID/BACKUP_S3_SECRET_ACCESS_KEY
+# for you.
+
+bucket = "your-hetzner-bucket-name" # same bucket as BACKUP_S3_BUCKET
+key    = "tofu/terraform.tfstate"   # path *within* the bucket - keep this distinct from the backup/ prefix
+
+# Hetzner Object Storage doesn't have "AWS regions" - this just has to be a
+# syntactically valid region string, it isn't used to route the request (the
+# endpoint below does that). Match it to your bucket's actual location.
+region = "eu-central"
+
+endpoints = {
+  # e.g. https://nbg1.your-objectstorage.com - same value as BACKUP_S3_ENDPOINT
+  s3 = "https://your-location.your-objectstorage.com"
+}
+
+# Hetzner Object Storage isn't AWS: skip the AWS-specific validation/lookup
+# calls the backend would otherwise make, and address the bucket path-style
+# (https://endpoint/bucket) rather than AWS's virtual-hosted style.
+use_path_style               = true
+skip_credentials_validation  = true
+skip_region_validation       = true
+skip_requesting_account_id   = true
+skip_s3_checksum             = true
+skip_metadata_api_check      = true