[ci skip] Flatten module wrappers into stack roots

Remove the module "xxx" { source = "./module" } indirection layer
from all 66 service stacks. Resources are now defined directly in
each stack's main.tf instead of through a wrapper module.

- Merge module/main.tf contents into stack main.tf
- Apply variable replacements (var.tier -> local.tiers.X, renamed vars)
- Fix shared module paths (one fewer ../ at each level)
- Move extra files/dirs (factory/, chart_values, subdirs) to stack root
- Update state files to strip module.<name>. prefix
- Update CLAUDE.md to reflect flat structure

Verified: terragrunt plan shows 0 add, 0 destroy across all stacks.

stacks/nextcloud/module/chart_values.yaml

@@ -1,65 +0,0 @@
-nextcloud:
-  host: nextcloud.viktorbarzin.me
-  trustedDomains:
-    - nextcloud.viktorbarzin.me
-  # mail:
-  #   enabled: true
-  #   # the user we send email as
-  #   fromAddress: nextcloud@viktorbarzin.me
-  #   # the domain we send email from
-  #   domain: viktorbarzin.me
-  #   smtp:
-  #     host: mail.viktorbarzin.me
-  #     secure: starttls
-  #     port: 587
-  #     authtype: LOGIN
-  #     name: nextcloud@viktorbarzin.me
-  #     password:
-  extraEnv:
-    - name: TRUSTED_PROXIES
-      value: "10.0.0.0/8"
-    # - name: mail_smtpdebug
-    #   value: "true"
-    # - name: loglevel
-    #   value: "0"
-
-# internalDatabase:
-#   enabled: false
-
-externalRedis:
-  enabled: true
-  host: redis.redis.svc.cluster.local
-
-# Currently not in use; we use the nextcloud.db sqlite3
-externalDatabase:
-  enabled: false
-  type: mysql
-  host: mysql.dbaas.svc.cluster.local
-  user: nextcloud
-  password: ${db_password}
-  databse: nextcloud
-
-persistence:
-  enabled: true
-  existingClaim: nextcloud-data-pvc
-
-  accessMode: ReadWriteOnce
-  size: 100Gi
-
-startupProbe:
-  enabled: true
-  initialDelaySeconds: 10
-  periodSeconds: 10
-  timeoutSeconds: 5
-  failureThreshold: 30
-  successThreshold: 1
-
-podAnnotations:
-  diun.enable: "true"
-  diun.include_tags: "^[0-9]+(?:.[0-9]+)?(?:.[0-9]+)?.*"
-
-collabora:
-  enabled: false # Using onlyoffice instead
-
-cronjob:
-  enabled: true