Decommission the orphaned legacy blog.alunduil.com GCS buckets

## Context

Three legacy Cloud Storage buckets in the `alunduil` project once hosted the static site for blog.alunduil.com:

- `blog.alunduil.com`
- `d.blog.alunduil.com`
- `r.blog.alunduil.com`

The blog has since moved off GCS. #13 (merged 2026-05-09) cut blog.alunduil.com over to GitHub Pages with DNS on Cloudflare, and destroyed the `d.blog`/`r.blog` CNAMEs that pointed at these buckets. Live DNS confirms it:

```
$ dig +short blog.alunduil.com CNAME
alunduil.github.io.
```

The three buckets are now **orphaned** — no DNS points at them, nothing serves from them. The original goal of importing them into Terraform no longer makes sense; the right outcome is to delete them.

## The blocker

Every `storage.buckets.get` / `storage.buckets.getIamPolicy` call returns HTTP 403, even for the project owner — likely a legacy domain-verified or pre-IAM project-group ACL whose principal the modern auth surface doesn't expose. Deletion needs `storage.buckets.delete`, which reads the bucket first, so it hits the same 403 wall. This can't be driven from Terraform or the standard CLI.

### What was tried

1. `terraform plan` (via import block) → 403 `storage.buckets.get`
2. `gsutil acl ch -u alunduil@gmail.com:O gs://...` → 403 (reads ACL first)
3. `gcloud storage buckets add-iam-policy-binding ... --role=roles/storage.admin` → 403 `storage.buckets.getIamPolicy`
4. GCP Console → bucket → Permissions tab → blocked

## Paths to explore

- **Google Cloud Support** — open a ticket; support can inspect the bucket's actual ACL and restore admin access (or delete the buckets directly).
- **Domain re-verification** — re-verify ownership of `alunduil.com` in Search Console under `alunduil@gmail.com`; some legacy domain-verified buckets unlock when the verified-domain owner re-asserts ownership.

## Done when

- All three buckets are deleted from the `alunduil` project.
- The placeholder comment block in `terraform/alunduil/storage.tf` (and this issue reference) is removed.

Note: the `storage-api` / `storage-component` services in `project.tf` stay enabled — the Terraform remote state bucket needs them; this is unrelated to the blog buckets.