chore: Restructured infra modules

infra/modules/network/main.tf

@@ -0,0 +1,13 @@
+# Private network shared by dev and prod (see docs/architecture.md "network" group).
+# vpn is intentionally not attached to this network - it sits outside it in the diagram.
+resource "hcloud_network" "main" {
+  name     = "server-network"
+  ip_range = var.ip_range
+}
+
+resource "hcloud_network_subnet" "main" {
+  network_id   = hcloud_network.main.id
+  type         = "cloud"
+  network_zone = var.network_zone
+  ip_range     = var.subnet_ip_range
+}

infra/modules/network/outputs.tf

@@ -0,0 +1,9 @@
+output "id" {
+  value = hcloud_network.main.id
+}
+
+# Exposed so dependents can depend_on the subnet existing, not just the network -
+# attaching a server to a network fails if the network has no subnet yet.
+output "subnet_id" {
+  value = hcloud_network_subnet.main.id
+}

infra/modules/network/variables.tf

@@ -0,0 +1,14 @@
+variable "ip_range" {
+  description = "IP range of the private network shared by dev and prod."
+  type        = string
+}
+
+variable "network_zone" {
+  description = "Hetzner Cloud network zone matching var.location."
+  type        = string
+}
+
+variable "subnet_ip_range" {
+  description = "IP range of the network subnet shared by dev and prod."
+  type        = string
+}