Add Pi-hole and Traefik LXC containers

- LXC 103 (pihole): Debian 12, 10.10.1.2, Pi-hole v6 with local DNS for
  gitea/grafana/traefik/pihole.homelab, Proxmox dnsmasq updated to use
  Pi-hole upstream
- LXC 104 (traefik): Debian 12, 10.10.1.3, Traefik v3 routing
  gitea.homelab → 10.10.1.125:3000, grafana.homelab → 10.10.1.137:3000
- DNAT rules on vmbr0 forwarding :80/:443 to Traefik, persisted in
  /etc/network/interfaces
- Ansible roles: pihole, traefik; playbooks: pihole.yml, traefik.yml
- site.yml excludes Debian containers from Arch-specific common role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/inventory/hosts.yml

@@ -9,6 +9,10 @@ all:
           ansible_host: 10.10.1.125
         monitoring:
           ansible_host: 10.10.1.137
+        pihole:
+          ansible_host: 10.10.1.2
+        traefik:
+          ansible_host: 10.10.1.3
 
     monitoring_servers:
       hosts:
@@ -17,3 +21,11 @@ all:
     gitea_servers:
       hosts:
         gitea:
+
+    pihole_servers:
+      hosts:
+        pihole:
+
+    traefik_servers:
+      hosts:
+        traefik: