fix(iac): use state-migrate for admin token resource moves (#2420)

The `moved` blocks for admin token resources conflict with
`-target=module.init` in `apply-init`, causing Terraform to fail.
Replace them with `terraform state mv` commands in `state-migrate`,
which runs before `apply-init` in CI.

Author: dobrac

iac/provider-gcp/Makefile

@@ -116,6 +116,12 @@ init:
 .PHONY: state-migrate
 state-migrate:
 	@ printf "Running Terraform state migrations for env: `tput setaf 2``tput bold`$(ENV)`tput sgr0`\n\n"
+	@ $(tf_vars) $(TF) state mv 'random_password.api_admin_secret' 'module.init.random_password.api_admin_secret' || true
+	@ $(tf_vars) $(TF) state mv 'google_secret_manager_secret.api_admin_token' 'module.init.google_secret_manager_secret.api_admin_token' || true
+	@ $(tf_vars) $(TF) state mv 'google_secret_manager_secret_version.api_admin_token_value' 'module.init.google_secret_manager_secret_version.api_admin_token_value' || true
+	@ $(tf_vars) $(TF) state mv 'random_password.dashboard_api_admin_secret' 'module.init.random_password.dashboard_api_admin_secret' || true
+	@ $(tf_vars) $(TF) state mv 'google_secret_manager_secret.dashboard_api_admin_token' 'module.init.google_secret_manager_secret.dashboard_api_admin_token' || true
+	@ $(tf_vars) $(TF) state mv 'google_secret_manager_secret_version.dashboard_api_admin_token_value' 'module.init.google_secret_manager_secret_version.dashboard_api_admin_token_value' || true
 
 .PHONY: apply-init
 apply-init:

iac/provider-gcp/moved.tf

@@ -34,32 +34,3 @@ moved {
   to   = module.init.google_secret_manager_secret_version.supabase_jwt_secrets
 }
 
-moved {
-  from = random_password.api_admin_secret
-  to   = module.init.random_password.api_admin_secret
-}
-
-moved {
-  from = google_secret_manager_secret.api_admin_token
-  to   = module.init.google_secret_manager_secret.api_admin_token
-}
-
-moved {
-  from = google_secret_manager_secret_version.api_admin_token_value
-  to   = module.init.google_secret_manager_secret_version.api_admin_token_value
-}
-
-moved {
-  from = random_password.dashboard_api_admin_secret
-  to   = module.init.random_password.dashboard_api_admin_secret
-}
-
-moved {
-  from = google_secret_manager_secret.dashboard_api_admin_token
-  to   = module.init.google_secret_manager_secret.dashboard_api_admin_token
-}
-
-moved {
-  from = google_secret_manager_secret_version.dashboard_api_admin_token_value
-  to   = module.init.google_secret_manager_secret_version.dashboard_api_admin_token_value
-}