infra: add terraform bootstrap for s3 remote state

infra/terraform/bootstrap/main.tf

@@ -0,0 +1,61 @@
+terraform {
+  required_version = ">= 1.10.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.aws_region
+}
+
+# ──────────────────────────────────────────────
+# S3 Bucket — Terraform remote state storage
+# Native state locking via use_lockfile = true
+# (available from Terraform >= 1.10.0)
+# No DynamoDB table required
+# ──────────────────────────────────────────────
+resource "aws_s3_bucket" "terraform_state" {
+  bucket = var.state_bucket_name
+
+  lifecycle {
+    prevent_destroy = true
+  }
+
+  tags = {
+    Name      = var.state_bucket_name
+    Project   = "scalable-task-platform"
+    ManagedBy = "terraform-bootstrap"
+  }
+}
+
+resource "aws_s3_bucket_versioning" "terraform_state" {
+  bucket = aws_s3_bucket.terraform_state.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
+  bucket = aws_s3_bucket.terraform_state.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "terraform_state" {
+  bucket = aws_s3_bucket.terraform_state.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}

infra/terraform/bootstrap/outputs.tf

@@ -0,0 +1,9 @@
+output "state_bucket_name" {
+  description = "S3 bucket name for Terraform remote state — copy this into your main backend config"
+  value       = aws_s3_bucket.terraform_state.bucket
+}
+
+output "state_bucket_arn" {
+  description = "ARN of the Terraform state S3 bucket"
+  value       = aws_s3_bucket.terraform_state.arn
+}

infra/terraform/bootstrap/variables.tf

@@ -0,0 +1,10 @@
+variable "aws_region" {
+  description = "AWS region for all resources"
+  type        = string
+}
+
+variable "state_bucket_name" {
+  description = "Name of the S3 bucket that stores Terraform state. Must be globally unique."
+  type        = string
+  default     = "scalable-task-platform-tfstate"
+}