Automate inter-region VPN connectivity and routing

[lweberru]

Goal

Automate optional, explicit connectivity between regional Hub-Spoke deployments. Regional hubs must remain isolated unless an inter-region connection is configured.

Scope

• Model directed or bidirectional inter-region connections between supported regional hubs.
• Create VPN gateways, peers, and routes for the declared remote CIDRs.
• Handle tunnel endpoints that are only known after the first apply through a documented two-apply workflow or an equivalent safe mechanism.
• Expose connection and tunnel outputs by source and destination region.
• Add a complete example and plan tests.

Acceptance criteria

• No inter-region traffic is created unless configured explicitly.
• A declared eu01-to-eu02 connection creates the required VPN and route resources.
• Remote CIDRs and next hops are validated before apply.
• Outputs identify both regions and tunnel endpoints.
• An executable plan test covers the regional connection.