Add a Terraform starter module for provisioning a dedicated fleet-mode AMS host

[JSONbored]

Context

AMS's primary documented form factor is laptop mode, but nothing in the repo provisions a dedicated, always-on host for operators who want to run the miner as a fleet-mode CLI worker instead. The root terraform/ module is ORB-specific (a persistent multi-tenant server) and is out of scope for this change — there is no Terraform target anywhere that provisions infrastructure for packages/gittensory-miner. This issue adds a minimal, self-contained starter module under packages/gittensory-miner/terraform/.

Dependencies

None — independently shippable. This is a new, additive Terraform module with no coupling to other in-flight AMS issues.

Requirements

1. Create a new module directory at packages/gittensory-miner/terraform/ containing a minimal Terraform configuration (e.g. main.tf, variables.tf, outputs.tf).
2. The module must provision a single VM/instance resource behind a firewall/security-group that restricts inbound access to only what a CLI-worker host needs (no public HTTP endpoints exposed by default) — this is not the persistent multi-tenant server profile that root terraform/ targets.
3. The module must install Docker via cloud-init user-data (not a manual provisioner step), so the instance is ready to run the miner container on first boot.
4. The module must define and attach a persistent volume mounted at /data/miner so the append-only attempt log, prediction ledger, and any other local state survive instance recreation/replacement.
5. Default sizing (instance type, disk size) must reflect a CLI-worker host profile — modest compute/memory suitable for one AMS instance running periodic attempt-runner work — not ORB's higher-capacity multi-tenant defaults.
6. Expose variables for provider credentials, region, and instance size so operators can adapt the module without editing its body.
7. Add a README.md inside the new terraform/ directory documenting prerequisites, terraform init/plan/apply usage, and how the module's outputs map into AMS's existing self-host setup.
8. Must not modify the existing root terraform/ (ORB) module, its variables, or its state in any way.

Deliverables / Acceptance Criteria

• packages/gittensory-miner/terraform/ module added with main.tf/variables.tf/outputs.tf (or equivalent split)
• Cloud-init user-data installs Docker on first boot
• Persistent volume resource defined and mounted at /data/miner
• Firewall/security-group resource restricts inbound access to a CLI-worker profile (no public endpoints by default)
• Instance sizing defaults documented as CLI-worker-appropriate, distinct from ORB's profile
• README.md added inside the new module directory
• terraform fmt/terraform validate pass for the new module
• No changes made to the existing root terraform/ module

Test Coverage Requirements

This PR must ship with full test coverage for every changed line and branch — the repo's Codecov patch gate requires 99%+ coverage and the house standard is to aim for 100%, including both sides of every conditional/nullish-coalescing branch introduced. Since the primary artifact here is Terraform HCL (infrastructure-as-code under packages/gittensory-miner/terraform/, not src/**), Codecov's line/branch gate does not directly instrument the .tf files themselves — but any accompanying Node/shell tooling this issue adds under src/** (e.g. a wrapper script invoking terraform) must still hit the 99%+ bar with both success and failure paths tested. Add: (1) a terraform validate/terraform plan smoke check (scripted or CI-invoked) verifying the module has no syntax errors and produces a plan with no public inbound rules by default — the invariant being asserted, and (2) if any variable-validation logic is added (e.g. rejecting an invalid instance-size input), a unit test covering both the valid and invalid input branches. No regression test applies since this is new functionality, not a bug fix.

Expected Outcome

An operator who wants AMS running as a persistent fleet-mode CLI worker (rather than on a laptop) can run terraform apply against this new module to stand up a firewalled, Docker-ready host with durable /data/miner storage, without having to reverse-engineer ORB's unrelated root Terraform module.

Links & Resources

• New module location: packages/gittensory-miner/terraform/
• Existing (out-of-scope) reference: root terraform/ (ORB-specific, do not modify)
• Theme: Self-host packaging & docs

[linear-code]

JSO-3720