build: add OpenTofu to the dev shell and ignore its state

- flake.nix: add pkgs.opentofu to the devshell (LXC provisioning pilot).
- .gitignore: ignore tofu/.terraform/, *.tfstate*, *.tfplan and tofu/.env.
  The provider lock file (tofu/.terraform.lock.hcl) stays tracked on purpose:
  it pins the provider version.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

flake.nix

@@ -38,6 +38,8 @@
               pkgs.openssh
               pkgs.curl
               pkgs.gnumake
+              # Provisioning LXC на этапе пилота: см. tofu/README.md.
+              pkgs.opentofu
             ];
 
             shellHook = ''