Add Proxmox host role, WireGuard VPN, and public Gitea via Traefik HTTPS

Proxmox host role:
- Admin user setup, SSH hardening (port 2222, no root login)
- claude-code SFTP chroot user
- Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token)
- WireGuard VPN server (10.10.10.0/24) with Fedora client registered
- Proxmox firewall management via pvesh API (idempotent Python script)

Public Gitea exposure:
- Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix
  middleware for /git subpath, HTTP→HTTPS redirect
- Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/
- Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass

SSH config fixes:
- StrictHostKeyChecking no → accept-new across all hosts
- Proxmox jump host: port 2222, user adyrem (root login disabled)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/inventory/group_vars/claude_code_vms/vars.yml

@@ -1,2 +1,2 @@
 ansible_user: adyrem
-ansible_ssh_common_args: "-o ProxyJump=root@192.168.1.10 -o StrictHostKeyChecking=no"
+ansible_ssh_common_args: "-o ProxyJump=root@192.168.1.10 -o StrictHostKeyChecking=accept-new"

ansible/inventory/group_vars/proxmox_hosts/vars.yml

@@ -0,0 +1,17 @@
+ansible_user: adyrem
+ansible_become: true
+ansible_become_method: sudo
+ansible_port: 2222
+
+ssh_port: 2222
+
+claude_code_ssh_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINgCFi4cju1/dmyXkVtO1azFt9VvWNoYjuUjcw7IlJdC claude-code@homelab"
+
+duckdns_domain: adyrem
+duckdns_token: "{{ vault_duckdns_token }}"
+
+wireguard_port: 51820
+wireguard_peers:
+  - name: fedora
+    public_key: "ivtchk9pxEwYwusMzmn7Uq89LFV3uB1I8iYto0EJuy4="
+    allowed_ips: 10.10.10.2/32

ansible/inventory/group_vars/proxmox_hosts/vault.yml

@@ -0,0 +1,8 @@
+vault_duckdns_token: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          34386432626362373134333765386630616466383661623463363465353135633763623364366166
+          3233343837653638613262663537383630376635323031350a653464653166396165643136643163
+          66376663666332303337306165313337303261373033363834373031303335383839383139663461
+          3036356435613435660a323432303964326362646462653139656664653439346331323261636436
+          62343135373431326231333736613836366238663064623163336636393663633862383439363333
+          6530326532373062636237613765353039373164333063613331

ansible/inventory/hosts.yml

@@ -34,3 +34,8 @@ all:
     traefik_servers:
       hosts:
         traefik:
+
+    proxmox_hosts:
+      hosts:
+        proxmox:
+          ansible_host: 192.168.1.10