chore: automate README docs generation and formatting

Manual `terraform-docs markdown .` was fragile — no injection markers,
no idempotency check, and no consistent formatting pipeline.

Add terraform-docs inject mode with BEGIN/END_TF_DOCS markers in the
README so `terraform-docs .` regenerates only the managed section.
Wrap the injected block with prettier-ignore directives to prevent
prettier from reformatting tables (which would break terraform-docs
--output-check).

Restructure Makefile with three targets:
- `docs`: regenerate terraform-docs + prettier format README
- `fmt`: docs + terraform fmt -recursive
- `check`: verify all docs/formatting are current (CI-friendly)

Add node (LTS) and prettier to .mise.toml for markdown formatting.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.mise.toml

@@ -1,3 +1,5 @@
 [tools]
+"npm:prettier" = "latest"
+node = "lts"
 terraform = "latest"
 terraform-docs = "latest"

.terraform-docs.yml

@@ -0,0 +1,8 @@
+formatter: "markdown table"
+output:
+  file: "README.md"
+  mode: inject
+
+settings:
+  hide-empty: false
+  read-comments: true

Makefile

@@ -1,4 +1,13 @@
-.PHONY: docs
+.PHONY: docs fmt check
-.SILENT: docs
+
 docs:
-	terraform-docs markdown .
+	terraform-docs .
+	prettier --write README.md
+
+fmt: docs
+	terraform fmt -recursive
+
+check:
+	terraform-docs --output-check .
+	prettier --check README.md
+	terraform fmt -check -recursive

README.md

@@ -275,6 +275,8 @@ resource "cloudflare_record" "srv" {
 
 <!-- x-release-please-end -->
 
+<!-- prettier-ignore-start -->
+<!-- BEGIN_TF_DOCS -->
 ## Requirements
 
 | Name | Version |
@@ -294,7 +296,7 @@ No modules.
 ## Resources
 
 | Name | Type |
-| --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
+|------|------|
 | [cloudflare_record.dmarc](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/record) | resource |
 | [cloudflare_record.domainkeys](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/record) | resource |
 | [cloudflare_record.mta-sts-a](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/record) | resource |
@@ -312,7 +314,7 @@ No modules.
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-| ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------ | :------: |
+|------|-------------|------|---------|:--------:|
 | <a name="input_account_id"></a> [account\_id](#input\_account\_id) | Cloudflare Account ID | `string` | n/a | yes |
 | <a name="input_dmarc_dkim_mode"></a> [dmarc\_dkim\_mode](#input\_dmarc\_dkim\_mode) | The DMARC DKIM mode for alignment (options: `relaxed`, `strict`). | `string` | `"relaxed"` | no |
 | <a name="input_dmarc_fo"></a> [dmarc\_fo](#input\_dmarc\_fo) | Failure reporting options for DMARC (characters: `0`, `1`, `d`, `s`, separated by `:`). | `string` | `"1:d:s"` | no |
@@ -324,7 +326,7 @@ No modules.
 | <a name="input_dmarc_ttl"></a> [dmarc\_ttl](#input\_dmarc\_ttl) | TTL for `_dmarc` DNS record. `1` is auto. Default is `1`. | `number` | `1` | no |
 | <a name="input_domainkeys"></a> [domainkeys](#input\_domainkeys) | Map of domain keys with name, record type (`TXT` or `CNAME`), and value. | <pre>map(object({<br/>    type  = string<br/>    value = string<br/>  }))</pre> | `{}` | no |
 | <a name="input_mta_sts_max_age"></a> [mta\_sts\_max\_age](#input\_mta\_sts\_max\_age) | Maximum lifetime of the policy in seconds, up to 31557600, defaults to 604800 (1 week) | `number` | `604800` | no |
-| <a name="input_mta_sts_mode"></a> [mta\_sts\_mode](#input\_mta\_sts\_mode)            | MTA policy mode, <https://tools.ietf.org/html/rfc8461#section-5>                                                           | `string`                                                                        | `"testing"`                                            | no       |
+| <a name="input_mta_sts_mode"></a> [mta\_sts\_mode](#input\_mta\_sts\_mode) | MTA policy mode, https://tools.ietf.org/html/rfc8461#section-5 | `string` | `"testing"` | no |
 | <a name="input_mta_sts_mx"></a> [mta\_sts\_mx](#input\_mta\_sts\_mx) | Additional permitted MX hosts for the MTA STS policy. | `list(string)` | `[]` | no |
 | <a name="input_mx"></a> [mx](#input\_mx) | A map representing the MX records. Key is the mail server hostname and value is the priority. | `map(number)` | n/a | yes |
 | <a name="input_mx_subdomains"></a> [mx\_subdomains](#input\_mx\_subdomains) | List of sub-domains to also apply MX records to. | `list(string)` | `[]` | no |
@@ -336,5 +338,7 @@ No modules.
 ## Outputs
 
 | Name | Description |
-| ------------------------------------------------------------------------------------------------ | ------------------------------- |
+|------|-------------|
 | <a name="output_mta_sts_policy_url"></a> [mta\_sts\_policy\_url](#output\_mta\_sts\_policy\_url) | URL to the MTA-STS policy file. |
+<!-- END_TF_DOCS -->
+<!-- prettier-ignore-end -->