state: add SOPS-encrypted terraform state to git

- SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted)
- scripts/state-sync: encrypt/decrypt/commit wrapper
- scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy
- terragrunt.hcl: -backup=- prevents backup file accumulation
- .gitignore: track .tfstate.enc, ignore plaintext .tfstate
- Cleaned 964MB of stale backups (state/backups/, .backup files)

terragrunt.hcl

@@ -26,6 +26,11 @@ terraform {
     ]
   }
 
+  extra_arguments "no_backup" {
+    commands = ["apply", "plan", "destroy", "import"]
+    arguments = ["-backup=-"]
+  }
+
   extra_arguments "kube_config" {
     commands = get_terraform_commands_that_need_vars()
     arguments = [