feat(proxmox): Proxmox VM template + Terraform/OpenTofu VM creation

Manual, documented bare-metal Proxmox install + cloud-init template build
(deliberately not automated — a fragile one-time step). Terraform/OpenTofu
config creates rn-platform-01/rn-lab-host-01 from that template via the
bpg/proxmox provider, with configurable (not hardcoded) VM sizing.

Validated: tofu fmt, tofu init -backend=false (real provider download),
tofu validate -> Success. No paid state backend required (local state).

infra/proxmox/README.md

@@ -0,0 +1,41 @@
+# Proxmox — manual, one-time steps
+
+Deliberately NOT automated (Phase 4 §21: "do not over-automate bare-metal Proxmox installation
+if it becomes fragile" — a broken automated install of the one host that IS the only way in is
+a much worse failure mode than a documented manual step reviewed by a human once).
+
+## 1. Install Proxmox VE
+
+Standard ISO install on the Hetzner dedicated server, once purchased. Follow Proxmox's own
+install guide. Full checklist: `docs/PRODUCTION_DEPLOYMENT.md` §1-2.
+
+## 2. Build the cloud-init VM template
+
+One-time, either via `virt-customize`/manual, or Packer if already a comfortable tool here:
+
+```bash
+# On the Proxmox host, after downloading an Ubuntu 22.04 cloud image:
+qm create 9000 --name ubuntu-22.04-cloudinit --memory 2048 --cores 2 --net0 virtio,bridge=vmbr0
+qm importdisk 9000 jammy-server-cloudimg-amd64.img local-zfs
+qm set 9000 --scsihw virtio-scsi-pci --scsi0 local-zfs:vm-9000-disk-0
+qm set 9000 --ide2 local-zfs:cloudinit
+qm set 9000 --boot c --bootdisk scsi0
+qm set 9000 --serial0 socket --vga serial0
+qm set 9000 --agent enabled=1
+qm template 9000
+```
+
+Then apply `infra/proxmox/cloud-init/user-data.yaml` as the template's default cloud-init
+user-data (Proxmox's own cloud-init snippet mechanism — `Datacenter -> Storage -> snippets`).
+
+## 3. Hand off to Terraform + Ansible
+
+Once the template exists and tagged `template` (matching `infra/terraform/main.tf`'s data
+source filter), `infra/terraform/` can clone `rn-platform-01`/`rn-lab-host-01` from it, and
+`infra/ansible/site.yml` configures them. Neither of those needs further Proxmox-console work
+after this point — see `docs/RUNBOOK_FIRST_DEPLOYMENT.md`.
+
+## 4. Proxmox host firewall
+
+Apply `infra/firewall/proxmox-host.rules` manually (rendered with real values) — see that
+file's own header comment for why this one ruleset stays a manual apply, unlike the two VMs'.

infra/proxmox/cloud-init/user-data.yaml

@@ -0,0 +1,28 @@
+#cloud-config
+# Baseline cloud-init user-data baked into the VM template infra/terraform/ clones. Minimal on
+# purpose — infra/ansible/site.yml does the real configuration (Docker, firewall, TLS, the app
+# stack); this just gets a box far enough to be SSH-reachable and Ansible-manageable.
+
+package_update: true
+package_upgrade: true
+
+users:
+  - name: rootnode-deploy
+    groups: [sudo]
+    shell: /bin/bash
+    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
+    ssh_authorized_keys: []   # injected by Terraform's ssh_public_key variable at clone time
+
+ssh_pwauth: false
+disable_root: true
+
+packages:
+  - qemu-guest-agent
+  - curl
+  - ca-certificates
+
+runcmd:
+  - systemctl enable --now qemu-guest-agent
+
+# See infra/proxmox/README.md for how to bake this into a reusable template (packer or manual
+# virt-customize) before infra/terraform/ clones it.