Extract VPN Terraform resources into dedicated module

[benrfairless]

Summary

• Move the VPN instance, IAM, and security group resources into terraform/vpn-server module while keeping existing outputs intact.
• Wire the new module into the root configuration so root-level outputs and dependency inputs remain post-migration-ready.
• Preserve live infrastructure via the planned terraform state mv sequence and document the compatibility-centric interface.

Testing

• Not run (not requested)