[DO NO MERGE] Switch from Hetzner to deSec as DNS hosting provider

[btlogy]

Related to #56

This PR is only meant as a documented example to switch from Hetzner to deSec (and should fail due to the lack of token).

In practice, this migration will have to be done in 5 step with 2 separated PRs:

1. Create a deSec.io account and a valid API token for ToFu
2. Create new domain and records resources in deSec (rather than changing them like in the PR) using this API token as a new sops secret
3. Update the delegation at the registrar level (likely still Gandi) to point to deSec NS with the proper DNSSEC info (+ verification)
4. Destroy de Hetzner DNS resources (rather than changing them like in the PR)
5. Remove the Hetzner DNS API token from the sop secrets and cleanup the related account

[github-actions]

ToFu - core

Step	Outcome
✏️ Format	success
🔧 Init ️	failure
🔍 Validate	skipped
📄 Plan	skipped
🛂 Verify	skipped
👉 Result	with error(s) - see below

show change(s)

show error(s)

Pusher: @btlogy, Action: pull_request
Workflow: tahoe-lafs/infrastructure/.github/workflows/tf-core.yml@refs/pull/83/merge