Add Proxmox host role, WireGuard VPN, and public Gitea via Traefik HTTPS

Proxmox host role:
- Admin user setup, SSH hardening (port 2222, no root login)
- claude-code SFTP chroot user
- Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token)
- WireGuard VPN server (10.10.10.0/24) with Fedora client registered
- Proxmox firewall management via pvesh API (idempotent Python script)

Public Gitea exposure:
- Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix
  middleware for /git subpath, HTTP→HTTPS redirect
- Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/
- Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass

SSH config fixes:
- StrictHostKeyChecking no → accept-new across all hosts
- Proxmox jump host: port 2222, user adyrem (root login disabled)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/claude_code/templates/ssh_config.j2

@@ -1,16 +1,18 @@
 # Proxmox host — jump host only, no shell
 Host proxmox
     HostName 192.168.1.10
-    User root
+    Port 2222
+    User adyrem
     IdentityFile ~/.ssh/homelab_ed25519
-    StrictHostKeyChecking no
+    StrictHostKeyChecking accept-new
 
 # Proxmox SFTP — write files to host workspace
 Host proxmox-sftp
     HostName 192.168.1.10
+    Port 2222
     User claude-code
     IdentityFile ~/.ssh/claude-code_ed25519
-    StrictHostKeyChecking no
+    StrictHostKeyChecking accept-new
 
 # Infra VMs — via ProxyJump through Proxmox
 Host gitea-vm
@@ -18,25 +20,25 @@ Host gitea-vm
     User adyrem
     ProxyJump proxmox
     IdentityFile ~/.ssh/homelab_ed25519
-    StrictHostKeyChecking no
+    StrictHostKeyChecking accept-new
 
 Host monitoring-vm
     HostName 10.10.1.137
     User adyrem
     ProxyJump proxmox
     IdentityFile ~/.ssh/homelab_ed25519
-    StrictHostKeyChecking no
+    StrictHostKeyChecking accept-new
 
 Host pihole-ct
     HostName 10.10.1.2
     User root
     ProxyJump proxmox
     IdentityFile ~/.ssh/homelab_ed25519
-    StrictHostKeyChecking no
+    StrictHostKeyChecking accept-new
 
 Host traefik-ct
     HostName 10.10.1.3
     User root
     ProxyJump proxmox
     IdentityFile ~/.ssh/homelab_ed25519
-    StrictHostKeyChecking no
+    StrictHostKeyChecking accept-new