Repo hygiene: fill stack-and-commands, normalize workplan statuses

- Fill .claude/rules/stack-and-commands.md (was an empty TODO template)
- Normalize workplan frontmatter statuses to canonical vocabulary
  (completed/done -> finished) per ADR-001

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/rules/stack-and-commands.md

@@ -1,19 +1,22 @@
 ## Stack
 
-<!-- TODO: Fill in language, frameworks, and key dependencies -->
-- **Language:**
-- **Key deps:**
+- **Language:** Terraform (HCL), cloud-init, Ansible, Bash
+- **Key deps:** Hetzner/HostEurope provisioning, SOPS + age for secrets, repo-local git hooks (`.githooks`)
 
 ## Dev Commands
 
 ```bash
-# TODO: Fill in the standard commands for this repo
-
-# Install dependencies
-
-# Run tests
-
-# Lint / type check
-
-# Build / package (if applicable)
+make help            # list all targets
+make hooks           # configure repo-local git hooks (secrets guard)
+make check-secrets   # fail if anything in secrets/ is not SOPS-encrypted
+make sops-edit       # edit global secrets with SOPS
+make sops-encrypt FILE=secrets/foo.yaml
+make tf-fmt          # terraform fmt
+make tf-init && make tf-plan   # plan (needs decrypted HCLOUD_TOKEN)
+make tf-apply        # provision — production-touching
+make tf-destroy      # tear down — destructive, operator only
 ```
+
+`tf-apply`/`tf-destroy` change production infrastructure — operator approval
+required. No unit test suite; validation is `tf-plan` + the server test suite
+workplans.