feat(proxmox): Proxmox VM template + Terraform/OpenTofu VM creation

Manual, documented bare-metal Proxmox install + cloud-init template build
(deliberately not automated — a fragile one-time step). Terraform/OpenTofu
config creates rn-platform-01/rn-lab-host-01 from that template via the
bpg/proxmox provider, with configurable (not hardcoded) VM sizing.

Validated: tofu fmt, tofu init -backend=false (real provider download),
tofu validate -> Success. No paid state backend required (local state).

infra/proxmox/cloud-init/user-data.yaml

@@ -0,0 +1,28 @@
+#cloud-config
+# Baseline cloud-init user-data baked into the VM template infra/terraform/ clones. Minimal on
+# purpose — infra/ansible/site.yml does the real configuration (Docker, firewall, TLS, the app
+# stack); this just gets a box far enough to be SSH-reachable and Ansible-manageable.
+
+package_update: true
+package_upgrade: true
+
+users:
+  - name: rootnode-deploy
+    groups: [sudo]
+    shell: /bin/bash
+    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
+    ssh_authorized_keys: []   # injected by Terraform's ssh_public_key variable at clone time
+
+ssh_pwauth: false
+disable_root: true
+
+packages:
+  - qemu-guest-agent
+  - curl
+  - ca-certificates
+
+runcmd:
+  - systemctl enable --now qemu-guest-agent
+
+# See infra/proxmox/README.md for how to bake this into a reusable template (packer or manual
+# virt-customize) before infra/terraform/ clones it.