docs: TCS cloud foundations reference architecture

[arjunmehta-git]

Summary

Adds the cloud foundations reference architecture document for client engagements.

Contents

• Mermaid flowchart: Control Tower through account vending to per-account baseline and GitOps/provisioning layer
• Design principles: Least Privilege, Defense in Depth, Automation-First, Everything via Code, Drift Prevention
• Components table: VPC module, IAM baseline, Crossplane PostgresDatabase, Security Baseline (planned)
• Getting Started section linking back to tcs-cloud-foundations

[sarajkrishnasingh]

Looks good. Should we add a 'When NOT to use this' section? Some clients have existing VPC setups and just need the IAM/security baseline. Worth calling that out to avoid confusion.