tf-unused-vars — catch dead Terraform variables, locals, and outputs before they pile up

Find declared-but-unused Terraform variables, locals, and outputs in a module and fail CI so dead configuration never accumulates.