Feature/1175 add minos support

[daniele-20tab]

Summary

Modernizes the Django bootstrapper to produce Minos-aligned service repos. Deployments now run via the Minos service module image and OpenTofu GitLab Components (opentofu/apply@3.11.0); the legacy stacks + deployment_type + environments_distribution model is replaced with an env_to_cluster mapping (default {development: dev, staging: dev, production: main}).

Reference output: gs1-one/api. Part of TG-1175 (sister PRs on nextjs-continuous-delivery and talos).

Highlights

• stacks + environments_distribution + deployment_type ⟶ env_to_cluster: dict[str, str]; per-env cluster_slug threaded through cookiecutter context
• Emits minos/ skeleton (common.tfvars + {development,staging,production}/{this.tfvars,shared-config.yaml}) replacing the legacy terraform/ + scripts/deploy/ layout
• New service-style .gitlab-ci.yml (stages: Build / Test / Pact-verify / Pact-check / Deploy / Pact-tag / Report / Sentry); deploy job extends ${CI_SERVER_FQDN}/components/opentofu/apply@3.11.0 with image registry.gitlab.com/20tab-open/minos/service:latest and TF_WORKSPACE=${PROJECT_SLUG}_${SERVICE_SLUG}_${CI_ENVIRONMENT_SLUG}
• Multi-stage Dockerfile on ghcr.io/astral-sh/uv:python3.14-bookworm-slim, uv sync --frozen, separate base/remote/local stages
• App-side migrated to uv + pyproject.toml (drops requirements/*.txt); scripts/ realigned to gs1-one/api (ci_test_entrypoint, ci_pact, ci_sentry, entrypoint, test, pact_verify, justfile)
• Vault secret seeding aligned to ${PROJECT_SLUG}/envs/{env}/{service_slug}/... (Talos owns ${PROJECT_SLUG}/envs/{env}/{key} env-shared paths)
• TFC bootstrap dropped: per-service workspaces are created by Talos via tfe_project + tfe_workspace (with default_execution_mode = "local" inherited); the sub-bootstrapper only forwards terraform_cloud_organization to the generated .gitlab-ci.yml
• Toolchain versions parametrized in cookiecutter context: python_version, minos_service_image, opentofu_component_version, opentofu_version (defaults match the current 20tab platform — overrideable when invoking Runner directly)

Breaking changes

• CLI: --deployment-type, --environments-distribution, --terraform-backend, --terraform-cloud-hostname, --terraform-cloud-token, --terraform-cloud-organization-create*, --terraform-cloud-admin-email removed
• cookiecutter.json: deployment_type, environments_distribution, stacks, terraform_backend removed; python_version, minos_service_image, opentofu_component_version, opentofu_version added
• Generated repos: terraform/, scripts/deploy/, requirements/*.txt no longer emitted; replaced by minos/ + pyproject.toml + uv.lock
• Bootstrap-side terraform/terraform-cloud/ module deleted
• Helper validate_or_prompt_email removed (only consumer was the dropped TFC flow)
• Constants: TERRAFORM_BACKEND_*, STACKS_*, *_ENV_STACK_*, DEPLOYMENT_TYPE_*, ENVIRONMENTS_DISTRIBUTION_* removed

API contract with talos

• Runner.gitlab_namespace_path accepts nested paths (e.g. 20tab/gs1-one); Talos sets it to {parent_group}/{project_slug} at init_subrepo time. No new parent_gitlab_group field — reuse of the existing one is sufficient.
• pact_* are not Runner params: secrets live at ${PROJECT_SLUG}/pact in Vault and are read at runtime by scripts/ci_pact.sh via the GitLab JWT auth backend.

Testing

• tests/test_collector.py updated: dropped test_deployment_type_*, test_environments_distribution_*, test_terraform_backend_*, test_terraform_cloud_*; added test_terraform_cloud_organization_{from_input,from_options}; trimmed test_collect and test_get_runner to the new field set.
• Cookiecutter render verified end-to-end against a Docker uv:python3.14-bookworm-slim smoke harness with the default toolchain values; output matches gs1-one/api fixtures.

Merge order

Land before the corresponding talos PR — talos clones the sub-bootstrappers via `BACKEND_TEMPLATE_URLS