feat: add manual terraform-destroy job to pipeline

- New 'destroy' stage at the end of the pipeline
- terraform-destroy job is when:manual so it only runs on explicit
  click in GitLab UI; allow_failure:false blocks accidental continuation
- Extract .terraform_setup anchor (image + before_script with init)
  shared between 'infra' and 'terraform-destroy' to avoid duplication
- Update variables comment to reflect container.admin and Terraform
  backend variables

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>