generated-terraform-ownership-namespace

# Centralize generated Terraform identity and name generated Terraform files by plugin

Rework the Terraform n1x renders under `infra/` in three ways.

## Project identity in `infra/locals.tf`

Render a new `infra/locals.tf` that holds the project's identity as these
Terraform locals:

| local | value |
|---|---|
| `app_id` | the project's app id |
| `app_description` | the project's description, resolved as n1x resolves it today |
| `gcp_project_id` | the project's GCP project id, derived as n1x derives it today |
| `github_owner` | the org's GitHub owner |
| `org_domain` | the org's domain |
| `region` | `us-central1` |

Every other generated Terraform file takes these values from the locals.
Project identity is no longer overridable through infra variables: the
`app_id`, `region`, `github_owner` and `github_repository_description`
variables go away, and n1x no longer renders identity values into any other
generated Terraform file except `infra/backend.tf`.

## Plugin-owned file names

Name each root Terraform file a plugin contributes to `infra/` as
`infra/n1x.<plugin>.tf`, where `<plugin>` is the plugin whose manifest
contributes the file. Where one plugin's files need telling apart, add a
part: `infra/n1x.<plugin>.<part>.tf`. Only `infra/backend.tf`,
`infra/versions.tf` and `infra/locals.tf` keep conventional names.

Each plugin's source template carries the same file name as the file it
generates.

## Upgrading projects

Running `n1x apply` on a project generated by n1x before this change must
delete the Terraform files under `infra/` that the previous version
generated and this one no longer generates, so an upgraded project never
keeps duplicate or stale definitions. Leave everything n1x did not generate
alone, including user-authored Terraform elsewhere under `infra/`.

## Environment

This is the n1x repository itself: it has no app or database of its own to
run. `terraform` is installed, and the Terraform providers a generated
project's `infra/` uses (google, google-beta, github, vercel, neon, posthog,
restapi, pagerduty, random, time and null, one version of each) come from a
local mirror, so `terraform init -backend=false` works offline in a rendered
project's `infra/`. There are no cloud or service credentials here.