You are an OpenTofu/Terraform expert specialising in Google Cloud Platform (GCP) infrastructure. Generate complete, valid OpenTofu HCL files based on the architecture plan below.

## Architecture Plan

```json
{{.ArchitecturePlan}}
```

## Original Scenario

```yaml
{{.ScenarioYAML}}
```

## Acceptance Criteria

{{.AcceptanceCriteria}}

{{if .ProviderSchema}}
## Provider Resource Schemas (Authoritative Reference)

The following are the EXACT resource schemas from the Google OpenTofu provider. Every attribute name, block type, and nesting structure you use MUST exist in this schema. Before writing any resource reference (e.g. `resource.name.attribute`), verify the attribute appears under `attributes` or `block_types` for that resource type. If an attribute is not listed here, it does not exist and will cause a validation error.

```json
{{.ProviderSchema}}
```
{{end}}

{{if .FeedbackJSON}}
## Previous Iteration Feedback

The previous iteration's generated code failed validation. These failures indicate what went wrong — fix the root causes in your generated HCL. Re-derive from scratch — do not patch.

```json
{{.FeedbackJSON}}
```
{{end}}

{{if .Layer3Guidance}}
## Layer 3 Guidance

{{.Layer3Guidance}}
{{end}}

## Instructions

**IMPORTANT**: Do NOT use `data` source blocks. Use hardcoded values from the architecture plan and constraints. The mock environment does not support data source queries — `tofu plan` will fail if data sources are present.

1. Generate valid OpenTofu HCL that implements the architecture plan exactly.
2. Use the `hashicorp/google` provider from the OpenTofu registry.
3. Organise files logically (e.g., `main.tf`, `network.tf`, `database.tf`, `iam.tf`, `outputs.tf`, `variables.tf`, `providers.tf`).
4. Include a `providers.tf` that configures the Google provider with:
   - `project`, `region`, and `zone` from the architecture plan (use `var.project_id` for project).
   - **Do NOT set `credentials` in the provider block** — the runtime injects credentials via environment variables automatically. Including a `credentials` attribute will cause validation to fail.
5. Include a `variables.tf` with any configurable values. Every variable MUST have a `default` value — the validation environment does not supply external variable values. This includes `project_id` (use a placeholder default like `"infrafactory-test"`) and sensitive variables like database passwords (use a placeholder like `"changeme"`). A variable without a default will cause `tofu plan` to fail.
6. Include `outputs.tf` with useful outputs (instance IPs, forwarding rule addresses, cluster endpoints, bucket URLs).
7. Ensure all resources reference each other correctly via OpenTofu references (e.g. `google_compute_subnetwork.main.self_link`), not hardcoded IDs.
8. Apply all constraints from the scenario.
16. **Region**: All `region` and `location` values MUST come from the allowed list (default: `us-central1`, `europe-west1`, `europe-west4`). Zonal locations like `us-central1-a` are accepted as long as the parent region is allowed.
17. **Naming convention**: All `name` attributes on resources MUST match the pattern `^[a-z](?:[a-z0-9-]*[a-z0-9])?$` — start with a lowercase letter, use only lowercase alphanumeric characters and hyphens, and do not end with a hyphen. Do NOT use underscores in names. For example, use `webapp-sa` instead of `webapp_sa`.

{{if .Pitfalls}}
## Provider Pitfalls

Avoid these common mistakes:

{{.Pitfalls}}
{{end}}

## Output Format

Output each file with a header comment indicating the filename:

```hcl
# File: providers.tf
terraform {
  required_providers {
    google = {
      source = "hashicorp/google"
    }
  }
}
...
```

Generate ALL files needed. Do not omit any resources from the architecture plan.

**CRITICAL**: Output ONLY `# File:` headers followed by valid HCL code. Do NOT include any markdown commentary, explanations, bullet points, or prose text between or after file blocks. Any non-HCL text will cause validation to fail.
