Add technitium_enabled toggle and turn DNS management off

module.technitium was gated only on the API token being present in
Infisical, so the single way to stop Terraform reconciling DNS was to pull
the token -- which also disables anything else that needs it. This adds an
explicit switch that ANDs with the existing token check, so the token can
stay put.

Set to false for now: DNS is being moved by hand during the domain
migration, and an apply in the middle of that would fight it.

Co-Authored-By: Claude Opus 5 <[email protected]>

main.tf

@@ -15,7 +15,7 @@ locals {
     )
   ])
 
-  technitium_enabled = try(data.external.infisical.result["technitium_api_token"], "") != ""
+  technitium_enabled = var.technitium_enabled && try(data.external.infisical.result["technitium_api_token"], "") != ""
   ipam_enabled       = try(data.external.infisical.result["ipam_username"], "") != ""
   caddy_enabled      = var.caddy_host != ""