feat(bootstrap): real olsitec.net config + DNS records (steps 1+2)

CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222),
cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort).
- components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF
  provider from encrypted token). Deployed + verified authoritative = 204.168.234.72.
- Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222,
  letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds).
  Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE.
- run.sh: reproducible deploy (passphrase + ssh key from pass/home).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bootstrap/lib/context.ts

@@ -34,7 +34,10 @@ export interface DeployCtx extends BaseCtx {
 export type ComponentFactory<T> = (ctx: DeployCtx) => T;
 
 function providerHost(cfg: FoundationConfig): string {
-  return process.env.FOUNDATION_DOCKER_HOST || `ssh://${cfg.vm.user}@${cfg.vm.host}`;
+  return (
+    process.env.FOUNDATION_DOCKER_HOST ||
+    `ssh://${cfg.vm.user}@${cfg.vm.host}:${cfg.vm.sshPort}`
+  );
 }
 
 /**