Add an infrastructure topology DSL for P2P IaC

[flo2517]

Provide a declarative language for describing multi-workload topologies — multi-region deployments, private and public tiers, and the connectivity between them — so that a complex deployment is a reviewable artifact rather than a sequence of API calls. This is the user-facing surface that makes the mesh (#53), gateways (#54), and naming (#55) usable together.

No ADR gate is required while the language is evaluated entirely off-chain — ADR-012 §6 records this explicitly. If any part of it is ever evaluated in the runtime, it falls under ADR-016 and inherits the determinism, bounded-input, and no-floats rules of AGENTS.md.

Acceptance criteria:

• the language is declarative and its evaluation is deterministic: the same document yields the same topology, with no dependence on evaluation order, wall-clock time, or ambient environment;
• evaluation is bounded — no unbounded recursion, expansion, or resource consumption from a hostile document, and limits are enforced rather than documented;
• a document is validated in full before anything is deployed, and a partially valid document deploys nothing;
• changes are diffable: a user can see what a modified document will create, change, and destroy before it is applied, and destruction is never implicit;
• the language expresses the lease, connectivity, and placement constraints the platform actually enforces, and cannot express a topology the platform will silently fail to deliver;
• no secrets are embedded in topology documents; secret references are indirect, per the secrets row of ADR-012 §3;
• documents are versioned with a stated compatibility policy, so an older document does not silently change meaning after an upgrade;
• tests cover a valid multi-region topology, a document with a cycle, an over-large or expansion-bomb document, an invalid partial document deploying nothing, a destructive diff requiring confirmation, and version-skew between document and platform.

---

Original request (FR, preserved verbatim):

Créer un langage de description pour définir des réseaux de workloads complexes (multi-régions, privé/public).