fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]

6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/state-sync

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+STATE_DIR="$REPO_ROOT/state/stacks"
+VAULT_ADDR="${VAULT_ADDR:-https://vault.viktorbarzin.me}"
+
+cmd="${1:-help}"
+stack="${2:-}"  # optional: operate on single stack
+
+# Check if Vault token is valid
+vault_available() {
+  VAULT_ADDR="$VAULT_ADDR" vault token lookup &>/dev/null 2>&1
+}
+
+# Per-stack Transit key URI
+transit_uri() {
+  local stack_name="$1"
+  echo "${VAULT_ADDR}/v1/transit/keys/sops-state-${stack_name}"
+}
+
+# Extract stack name from directory path
+stack_name_from_dir() {
+  basename "$1"
+}
+
+# Tier 0 stacks keep SOPS-encrypted local state; Tier 1 uses PG backend
+TIER0_STACKS="infra platform cnpg vault dbaas external-secrets"
+is_tier0() {
+  echo "$TIER0_STACKS" | tr ' ' '\n' | grep -qx "$1"
+}
+
+# Read age recipients from .sops.yaml
+AGE_RECIPIENTS="$(python3 -c "
+import yaml, sys
+with open('$REPO_ROOT/.sops.yaml') as f: c = yaml.safe_load(f)
+for r in c.get('creation_rules', []):
+    age = r.get('age', '')
+    if age:
+        print(age.replace('\n', '').strip())
+        break
+" 2>/dev/null || echo "")"
+
+encrypt_state() {
+  local dir="$1"
+  local src="$dir/terraform.tfstate"
+  local dst="$dir/terraform.tfstate.enc"
+  local name
+  name="$(stack_name_from_dir "$dir")"
+  [ -f "$src" ] || return 0
+  # Only re-encrypt if state is newer than encrypted version
+  if [ ! -f "$dst" ] || [ "$src" -nt "$dst" ]; then
+    sops -e --input-type json --output-type json \
+      --hc-vault-transit "$(transit_uri "$name")" \
+      --age "$AGE_RECIPIENTS" \
+      "$src" > "$dst"
+  fi
+}
+
+decrypt_state() {
+  local dir="$1"
+  local src="$dir/terraform.tfstate.enc"
+  local dst="$dir/terraform.tfstate"
+  [ -f "$src" ] || return 0
+
+  if vault_available; then
+    # Vault Transit — per-stack key, no local key needed
+    sops -d --input-type json --output-type json "$src" > "$dst"
+  elif [ -f "${SOPS_AGE_KEY_FILE:-$HOME/.config/sops/age/keys.txt}" ]; then
+    # Fallback: age key on disk (bootstrap / Vault down)
+    echo "state-sync: Vault unavailable, falling back to age key" >&2
+    SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE:-$HOME/.config/sops/age/keys.txt}" \
+      sops -d --input-type json --output-type json "$src" > "$dst"
+  else
+    echo "state-sync: ERROR — no Vault token and no age key at ~/.config/sops/age/keys.txt" >&2
+    return 1
+  fi
+}
+
+case "$cmd" in
+  encrypt)
+    if [ -n "$stack" ]; then
+      if is_tier0 "$stack"; then
+        encrypt_state "$STATE_DIR/$stack"
+      else
+        echo "state-sync: skipping Tier 1 stack '$stack' (PG backend)" >&2
+      fi
+    else
+      for dir in "$STATE_DIR"/*/; do
+        _name="$(stack_name_from_dir "$dir")"
+        if is_tier0 "$_name"; then
+          encrypt_state "$dir"
+        fi
+      done
+    fi
+    ;;
+  decrypt)
+    if [ -n "$stack" ]; then
+      if is_tier0 "$stack"; then
+        decrypt_state "$STATE_DIR/$stack"
+      else
+        echo "state-sync: skipping Tier 1 stack '$stack' (PG backend)" >&2
+      fi
+    else
+      for dir in "$STATE_DIR"/*/; do
+        _name="$(stack_name_from_dir "$dir")"
+        if is_tier0 "$_name"; then
+          decrypt_state "$dir"
+        fi
+      done
+    fi
+    ;;
+  commit)
+    # Only Tier 0 stacks have encrypted state in git
+    "$0" encrypt
+    cd "$REPO_ROOT"
+    git add state/stacks/*/terraform.tfstate.enc
+    if ! git diff --cached --quiet; then
+      git commit -m "state: update encrypted terraform state"
+    fi
+    ;;
+  help)
+    echo "Usage: state-sync {encrypt|decrypt|commit} [stack-name]"
+    echo "Operates on Tier 0 stacks only (infra, platform, cnpg, vault, dbaas, external-secrets)."
+    echo "Tier 1 stacks use the PG backend and don't need local state sync."
+    echo "Encrypt uses per-stack Vault Transit key (transit/keys/sops-state-<stack>)."
+    echo "Decrypt uses Vault Transit if logged in, falls back to age key."
+    ;;
+esac