ci: drop use_lockfile — Backblaze B2 can't do native state locking

B2's S3 API returns 501 NotImplemented for the conditional PutObject that
use_lockfile relies on, so tofu plan/apply fails to acquire the lock.
Revert the lockfile and the 1.10 version bump it required; rely on the
concurrency guard to serialize applies instead. Left a note in the
backend block so this isn't re-attempted.

.github/workflows/terraform.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v2
         with:
-          tofu_version: 1.10.10
+          tofu_version: 1.9.0
 
       - name: Install SOPS
         run: |
@@ -78,7 +78,7 @@ jobs:
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v2
         with:
-          tofu_version: 1.10.10
+          tofu_version: 1.9.0
 
       - name: Install SOPS
         run: |

.github/workflows/validate-terraform.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v2
         with:
-          tofu_version: 1.10.10
+          tofu_version: 1.9.0
 
       - name: Install SOPS
         run: |

terraform/providers.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.10.0"
+  required_version = ">= 1.6.0"
 
   required_providers {
     hcloud = {
@@ -24,7 +24,10 @@ terraform {
     region                      = "eu-central-003"
     skip_credentials_validation = true
     skip_region_validation      = true
-    use_lockfile                = true
+    # NOTE: no state locking — Backblaze B2's S3 API doesn't implement the
+    # conditional PutObject that OpenTofu's use_lockfile needs (returns 501
+    # NotImplemented). Concurrent applies are instead prevented by the
+    # `concurrency` guard in .github/workflows/terraform.yml.
     # Credentials read from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars
   }
 }