ToDo list (personal)

# make sure no `tf clients` / `tf core` or `bitte deploy` has to be run under any circumstance to "customize" the cluster for an app
- [ ] move host volumes into `hydrate`
- [ ] move consul ACL / connect config into `hydrate`

# separation of concerns
- [ ] use `nomad` `node_class` to differentiate client groups instead of `meta` (for one, `node_class` are prominently shown in the UI)
- [ ] implement `bitte -l ` so that the blast radius of bitte opreations is limited to a node class

# review dependencies `core` / `clients` tf
- [ ] so that `tf plan -target` correctly resolves all minimum dependencies for viability of a particular instance, specifically iam roles & such.

Start by reviewing the `hydrate` work and the `tf clients` / `tf core` boundaries described in the checklist. Then examine the Nomad `node_class` and `bitte -l ` requirements alongside `tf plan -target`; done means the checklist items are implemented without manual app customization and dependencies resolve for a viable instance.

Written by the indexing model from the issue text.