Add Pi-hole and Traefik LXC containers

- LXC 103 (pihole): Debian 12, 10.10.1.2, Pi-hole v6 with local DNS for
  gitea/grafana/traefik/pihole.homelab, Proxmox dnsmasq updated to use
  Pi-hole upstream
- LXC 104 (traefik): Debian 12, 10.10.1.3, Traefik v3 routing
  gitea.homelab → 10.10.1.125:3000, grafana.homelab → 10.10.1.137:3000
- DNAT rules on vmbr0 forwarding :80/:443 to Traefik, persisted in
  /etc/network/interfaces
- Ansible roles: pihole, traefik; playbooks: pihole.yml, traefik.yml
- site.yml excludes Debian containers from Arch-specific common role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/playbooks/site.yml

@@ -1,6 +1,6 @@
 ---
-- name: Common setup for all VMs
-  hosts: all
+- name: Common setup for all Arch VMs
+  hosts: all:!pihole_servers:!traefik_servers
   roles:
     - common
     - node_exporter
@@ -15,3 +15,13 @@
   hosts: gitea_servers
   roles:
     - gitea
+
+- name: Pi-hole
+  hosts: pihole_servers
+  roles:
+    - pihole
+
+- name: Traefik
+  hosts: traefik_servers
+  roles:
+    - traefik