Add AWS profile config and resoftware-iac OpenTofu state runbook

Track ~/.aws/config (profiles only, never credentials) as a copied
config: setup.sh restores it, update.fish refreshes it. Document the
S3 state backend setup for resoftware-iac in the README, including
the config/credentials profile-header gotcha behind "failed to get
shared config profile".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

setup.sh

@@ -60,9 +60,10 @@ ln -sf "$REPO_HOME/NuGet.Config"     ~/.nuget/NuGet/NuGet.Config
 
 # --- 5. Copied configs -------------------------------------------------------
 step "Restoring copied configs"
-mkdir -p ~/.claude ~/.serena
+mkdir -p ~/.claude ~/.serena ~/.aws
 cp "$REPO_HOME/claude-settings.json" ~/.claude/settings.json
 cp "$REPO_HOME/serena_config.yml"    ~/.serena/serena_config.yml
+cp "$REPO_HOME/aws-config"           ~/.aws/config
 echo "Updating /etc/hosts (sudo)"
 sudo cp "$REPO_HOME/hosts" /etc/hosts
 
@@ -95,7 +96,11 @@ cat <<'EOF'
      and put the *.pub files referenced in ssh-config into ~/.ssh/.
   2. iTerm2 > Settings > Profiles > Import JSON Profiles > iterm-profile.json.
   3. gh auth login, then: fish clone-resoftware-repos.fish
-  4. Optional: import meerkoet-proxy.conf into the WireGuard app.
-  5. Sign in to iCloud, browsers, Slack, Spark, Google Drive, Docker,
+  4. AWS/OpenTofu state access (see README "AWS + OpenTofu state access"):
+     aws configure --profile resoftware-iac   (iac user key, region eu-north-1)
+     aws login                                (root session, for applies)
+     and restore the gitignored terraform.tfvars per resoftware-iac stack.
+  5. Optional: import meerkoet-proxy.conf into the WireGuard app.
+  6. Sign in to iCloud, browsers, Slack, Spark, Google Drive, Docker,
      Todoist, JetBrains Toolbox; restore Alfred/BTT licenses.
 EOF