chore: pre-migration snapshot

Layer0, MCP servers, Terraform consolidation

terraform/assurance_negative_free_should_fail.tfvars

@@ -0,0 +1,34 @@
+cloudflare_api_token    = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" # Placeholder (format-valid)
+cloudflare_account_id   = "00000000000000000000000000000000"         # Placeholder (format-valid)
+cloudflare_account_name = ""
+
+trusted_admin_ips = []
+blocked_countries = []
+
+enable_managed_waf    = true
+enable_bot_management = true
+
+# Intentionally violates the "free plan must gate managed WAF + bot mgmt off".
+# Used by scripts/waf-and-plan-invariants.sh negative-control check.
+domains = {
+  "offsec.global" = {
+    plan       = "free"
+    jump_start = false
+  }
+  "offsecglobal.com" = {
+    plan       = "free"
+    jump_start = false
+  }
+  "offsecagent.com" = {
+    plan       = "free"
+    jump_start = false
+  }
+  "offsecshield.com" = {
+    plan       = "free"
+    jump_start = false
+  }
+  "vaultmesh.org" = {
+    plan       = "pro"
+    jump_start = false
+  }
+}