feat(staging): implement ephemeral staging VM provisioning and TrueNAS snapshot clone workflow

.forgejo/workflows/staging.yml

@@ -0,0 +1,62 @@
+name: Dynamic Staging Environment
+
+on:
+  pull_request:
+    types: [opened, synchronize, closed]
+
+jobs:
+  manage-staging:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Provision Staging Environment (Opened/Sync)
+        if: github.event.action == 'opened' || github.event.action == 'synchronize'
+        env:
+          PROXMOX_VE_ENDPOINT: "https://proxmox.local:8006/"
+          PROXMOX_VE_API_TOKEN: ${{ secrets.PROXMOX_TOKEN_SECRET }}
+          TF_VAR_pr_number: ${{ github.event.pull_request.number }}
+          # VM_ID could be dynamically generated or based on PR number (e.g., 8000 + PR_NUMBER)
+          TF_VAR_vm_id: ${{ format('8{0:03}', github.event.pull_request.number) }}
+          TF_VAR_staging_age_key: ${{ secrets.STAGING_AGE_KEY }}
+          
+          # TrueNAS integration (Secrets would need to be added to Forgejo)
+          TRUENAS_IP: "truenas.local"
+          TRUENAS_API_KEY: ${{ secrets.TRUENAS_API_KEY }}
+          POOL_NAME: "tank"
+          SOURCE_DATASET: "apps/production_data"
+        run: |
+          echo "Cloning datasets..."
+          # ./scripts/truenas-staging-clone.sh
+          
+          echo "Applying Terraform for PR ${{ github.event.pull_request.number }}..."
+          cd terraform/staging-env
+          terraform init
+          terraform apply -auto-approve
+
+      - name: Teardown Staging Environment (Closed)
+        if: github.event.action == 'closed'
+        env:
+          PROXMOX_VE_ENDPOINT: "https://proxmox.local:8006/"
+          PROXMOX_VE_API_TOKEN: ${{ secrets.PROXMOX_TOKEN_SECRET }}
+          TF_VAR_pr_number: ${{ github.event.pull_request.number }}
+          TF_VAR_vm_id: ${{ format('8{0:03}', github.event.pull_request.number) }}
+          TF_VAR_staging_age_key: ""
+          
+          # TrueNAS integration
+          TRUENAS_IP: "truenas.local"
+          TRUENAS_API_KEY: ${{ secrets.TRUENAS_API_KEY }}
+          POOL_NAME: "tank"
+          SOURCE_DATASET: "apps/production_data"
+        run: |
+          echo "Destroying Terraform environment for PR ${{ github.event.pull_request.number }}..."
+          cd terraform/staging-env
+          terraform init
+          terraform destroy -auto-approve
+          
+          echo "Tearing down datasets..."
+          # ./scripts/truenas-staging-teardown.sh