Add Pi-hole and Traefik LXC containers

- LXC 103 (pihole): Debian 12, 10.10.1.2, Pi-hole v6 with local DNS for
  gitea/grafana/traefik/pihole.homelab, Proxmox dnsmasq updated to use
  Pi-hole upstream
- LXC 104 (traefik): Debian 12, 10.10.1.3, Traefik v3 routing
  gitea.homelab → 10.10.1.125:3000, grafana.homelab → 10.10.1.137:3000
- DNAT rules on vmbr0 forwarding :80/:443 to Traefik, persisted in
  /etc/network/interfaces
- Ansible roles: pihole, traefik; playbooks: pihole.yml, traefik.yml
- site.yml excludes Debian containers from Arch-specific common role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/pihole/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+pihole_password: "{{ vault_pihole_password }}"
+pihole_dns_upstream1: "8.8.8.8"
+pihole_dns_upstream2: "8.8.4.4"
+pihole_local_domain: "homelab"
+pihole_interface: "eth0"
+pihole_dns_hosts:
+  - { ip: "10.10.1.2",   host: "pihole.homelab" }
+  - { ip: "10.10.1.3",   host: "traefik.homelab" }
+  - { ip: "10.10.1.125", host: "gitea.homelab" }
+  - { ip: "10.10.1.137", host: "grafana.homelab" }