add budget alert and nightly OS-update reboot

- $10/month project budget via google_billing_budget, alerts to admin_email
- forgejo-reboot.timer at 04:30 UTC applies staged COS updates
- relocate cloud-init scripts to /var/lib/google/forgejo (COS noexec on /var)
- runbook: updated zone, script paths, added "How updates work" section

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

terraform/variables.tf

@@ -22,7 +22,18 @@ variable "domain" {
 
 variable "admin_email" {
   type        = string
-  description = "Google account that gets IAP SSH access"
+  description = "Google account that gets IAP SSH access and budget alert emails"
+}
+
+variable "billing_account" {
+  type        = string
+  description = "Billing account ID (format: XXXXXX-XXXXXX-XXXXXX) for the budget alert"
+}
+
+variable "budget_amount_usd" {
+  type        = number
+  default     = 10
+  description = "Monthly budget in USD; alerts fire at 50%, 90%, 100% of this"
 }
 
 variable "forgejo_image" {