[ci skip] Flatten module wrappers into stack roots

Remove the module "xxx" { source = "./module" } indirection layer
from all 66 service stacks. Resources are now defined directly in
each stack's main.tf instead of through a wrapper module.

- Merge module/main.tf contents into stack main.tf
- Apply variable replacements (var.tier -> local.tiers.X, renamed vars)
- Fix shared module paths (one fewer ../ at each level)
- Move extra files/dirs (factory/, chart_values, subdirs) to stack root
- Update state files to strip module.<name>. prefix
- Update CLAUDE.md to reflect flat structure

Verified: terragrunt plan shows 0 add, 0 destroy across all stacks.

stacks/shadowsocks/main.tf

@@ -10,8 +10,107 @@ locals {
   }
 }
 
-module "shadowsocks" {
-  source = "./module"
-  password                       = var.shadowsocks_password
-  tier                           = local.tiers.edge
+variable "method" {
+  default = "chacha20-ietf-poly1305"
+}
+
+resource "kubernetes_namespace" "shadowsocks" {
+  metadata {
+    name = "shadowsocks"
+    labels = {
+      tier = local.tiers.edge
+    }
+    # TLS termination seems iffy - I get pfsense MiTM-ing
+    # labels = {
+    #   "istio-injection" : "enabled"
+    # }
+  }
+}
+
+resource "kubernetes_deployment" "shadowsocks" {
+  metadata {
+    name      = "shadowsocks"
+    namespace = kubernetes_namespace.shadowsocks.metadata[0].name
+    labels = {
+      "app" = "shadowsocks"
+      tier  = local.tiers.edge
+    }
+    annotations = {
+      "reloader.stakater.com/search" = "true"
+    }
+  }
+  spec {
+    replicas = "1"
+    selector {
+      match_labels = {
+        "app" = "shadowsocks"
+      }
+    }
+    template {
+      metadata {
+        labels = {
+          "app" = "shadowsocks"
+        }
+      }
+      spec {
+        container {
+          name              = "shadowsocks"
+          image             = "shadowsocks/shadowsocks-libev"
+          image_pull_policy = "IfNotPresent"
+          env {
+            name  = "METHOD"
+            value = var.method
+          }
+          env {
+            name  = "PASSWORD"
+            value = var.shadowsocks_password
+          }
+          port {
+            container_port = 8388
+            protocol       = "TCP"
+          }
+          port {
+            container_port = 8388
+            protocol       = "UDP"
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "mailserver" { # rename me
+  metadata {
+    name      = "shadowsocks"
+    namespace = kubernetes_namespace.shadowsocks.metadata[0].name
+
+    labels = {
+      app = "shadowsocks"
+    }
+    annotations = {
+      "metallb.universe.tf/allow-shared-ip" = "shared"
+    }
+  }
+
+  spec {
+    type                    = "LoadBalancer"
+    external_traffic_policy = "Cluster"
+    selector = {
+      app = "shadowsocks"
+    }
+
+    port {
+      name        = "shadowsocks-tcp"
+      protocol    = "TCP"
+      port        = 8388
+      target_port = "8388"
+    }
+
+    port {
+      name        = "shadowsocks-udp"
+      protocol    = "UDP"
+      port        = 8388
+      target_port = "8388"
+    }
+  }
 }

stacks/shadowsocks/module/main.tf

@@ -1,106 +0,0 @@
-variable "password" {}
-variable "tier" { type = string }
-variable "method" {
-  default = "chacha20-ietf-poly1305"
-}
-
-resource "kubernetes_namespace" "shadowsocks" {
-  metadata {
-    name = "shadowsocks"
-    labels = {
-      tier = var.tier
-    }
-    # TLS termination seems iffy - I get pfsense MiTM-ing
-    # labels = {
-    #   "istio-injection" : "enabled"
-    # }
-  }
-}
-
-resource "kubernetes_deployment" "shadowsocks" {
-  metadata {
-    name      = "shadowsocks"
-    namespace = kubernetes_namespace.shadowsocks.metadata[0].name
-    labels = {
-      "app" = "shadowsocks"
-      tier  = var.tier
-    }
-    annotations = {
-      "reloader.stakater.com/search" = "true"
-    }
-  }
-  spec {
-    replicas = "1"
-    selector {
-      match_labels = {
-        "app" = "shadowsocks"
-      }
-    }
-    template {
-      metadata {
-        labels = {
-          "app" = "shadowsocks"
-        }
-      }
-      spec {
-        container {
-          name              = "shadowsocks"
-          image             = "shadowsocks/shadowsocks-libev"
-          image_pull_policy = "IfNotPresent"
-          env {
-            name  = "METHOD"
-            value = var.method
-          }
-          env {
-            name  = "PASSWORD"
-            value = var.password
-          }
-          port {
-            container_port = 8388
-            protocol       = "TCP"
-          }
-          port {
-            container_port = 8388
-            protocol       = "UDP"
-          }
-        }
-      }
-    }
-  }
-}
-
-resource "kubernetes_service" "mailserver" { # rename me
-  metadata {
-    name      = "shadowsocks"
-    namespace = kubernetes_namespace.shadowsocks.metadata[0].name
-
-    labels = {
-      app = "shadowsocks"
-    }
-    annotations = {
-      "metallb.universe.tf/allow-shared-ip" = "shared"
-    }
-  }
-
-  spec {
-    type                    = "LoadBalancer"
-    external_traffic_policy = "Cluster"
-    selector = {
-      app = "shadowsocks"
-    }
-
-    port {
-      name        = "shadowsocks-tcp"
-      protocol    = "TCP"
-      port        = 8388
-      target_port = "8388"
-    }
-
-    port {
-      name        = "shadowsocks-udp"
-      protocol    = "UDP"
-      port        = 8388
-      target_port = "8388"
-    }
-  }
-}