infra(tofu): fix backend.tf HCL header + document encryption-adoption migration

backend.tf began with a stray YAML `---` doc separator (invalid HCL) that broke
`tofu` parsing. Remove it. Also document the one-time `unencrypted` fallback method
needed to adopt encryption on pre-existing plaintext state (add for the migrate,
remove after), so the record is complete. State migration to R2 verified: 4/4
resources read back through the encrypt-only method (proves ciphertext at rest).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/tofu/backend.tf

@@ -1,4 +1,3 @@
----
 # Remote state — Cloudflare R2 (S3-compatible), stored OFF the k3s cluster.
 #
 # WHY OFF-CLUSTER (the load-bearing decision): tofu state must live at or below the layer it