feat(infra): add OpenAI API key for LLM features

Add openai_api_key variable to terraform configuration for AI-powered
features like flowchart generation. The key is stored as a k8s secret
and exposed to pods as LLM_OPENAI_API_KEY environment variable.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

infra/terraform/app.tf

@@ -15,6 +15,7 @@ resource "kubernetes_secret" "app_env" {
 
   data = {
     AUTH_SECRET        = var.auth_secret
+    LLM_OPENAI_API_KEY = var.openai_api_key
   }
 }
 

infra/terraform/terraform.tfvars.example

@@ -4,6 +4,9 @@
 letsencrypt_email = "your-email@example.com"
 auth_secret       = "generate-with-openssl-rand-base64-32"
 
+# Optional - AI features (flowchart generation, etc.)
+# openai_api_key    = "sk-..."
+
 # Optional overrides
 # app_domain        = "abaci.one"
 # app_image         = "ghcr.io/antialias/soroban-abacus-flashcards:latest"

infra/terraform/variables.tf

@@ -45,6 +45,13 @@ variable "auth_secret" {
   sensitive   = true
 }
 
+variable "openai_api_key" {
+  description = "OpenAI API key for LLM features (flowchart generation, etc.)"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
 variable "nfs_server" {
   description = "NFS server IP address (NAS)"
   type        = string