Enforce firewall=0 on vmbr2 VMs to prevent NAT breakage

When a VM has firewall=1, Proxmox inserts a fwbr bridge and iptables
POSTROUTING fires at the bridge step (OUT=fwbrNNNi0) rather than at
vmbr0. The MASQUERADE rule (-o vmbr0) never matches, so the VM loses
internet access.

Adds an idempotent task to the proxmox_host role that strips
firewall=1 from VM 105's net0 config whenever the playbook runs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/proxmox_host/tasks/main.yml

@@ -205,3 +205,20 @@
     enabled: true
     state: started
     daemon_reload: true
+
+# --- VM network firewall flags ---
+# vmbr2 VMs must have firewall=0 on their network interfaces.
+# When firewall=1, Proxmox creates a fwbr bridge; iptables POSTROUTING fires
+# at that bridge (OUT=fwbrNNNi0) before the packet reaches vmbr0, so the
+# MASQUERADE rule (-o vmbr0) never matches and VMs lose internet access.
+
+- name: Ensure claude-code VM (105) net0 has firewall disabled
+  ansible.builtin.shell: |
+    net0=$(qm config 105 | awk '/^net0:/ {print $2}')
+    if echo "$net0" | grep -q 'firewall=1'; then
+      qm set 105 --net0 "${net0//,firewall=1/,firewall=0}"
+      echo changed
+    fi
+  register: _vm105_fw
+  changed_when: "'changed' in _vm105_fw.stdout"
+  failed_when: false