A single-account, admin-key starting point — and the local-backend trick that lets one Terraform module manage its own state from zero.