ci(terraform): add repository rules as code (#4)

Manage GitHub repo settings and main branch protection via
terraform-module-github-repository, matching webdev-bot.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: wiktoriavh

.github/CODEOWNERS

@@ -0,0 +1 @@
+/terraform/repository/ @wiktoriavh

.github/workflows/terraform-repository.yml

@@ -0,0 +1,37 @@
+name: Terraform Repository
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - terraform/repository/**
+
+concurrency:
+  group: terraform-repository-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  apply:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: terraform/repository
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.5.0
+
+      - name: Terraform Init
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: terraform init
+
+      - name: Terraform Apply
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: terraform apply -auto-approve

terraform/repository/main.tf

@@ -84,6 +84,8 @@ module "repository" {
       required_pull_request_reviews = {
         # New commits dismiss previous approvals so reviewers re-check changes.
         dismiss_stale_reviews = true
+        # Require approval from CODEOWNERS when changed files match .github/CODEOWNERS.
+        require_code_owner_reviews = true
         # At least one approving review from someone other than the author.
         required_approving_review_count = 1
       }