Add Pi-hole and Traefik LXC containers

- LXC 103 (pihole): Debian 12, 10.10.1.2, Pi-hole v6 with local DNS for
  gitea/grafana/traefik/pihole.homelab, Proxmox dnsmasq updated to use
  Pi-hole upstream
- LXC 104 (traefik): Debian 12, 10.10.1.3, Traefik v3 routing
  gitea.homelab → 10.10.1.125:3000, grafana.homelab → 10.10.1.137:3000
- DNAT rules on vmbr0 forwarding :80/:443 to Traefik, persisted in
  /etc/network/interfaces
- Ansible roles: pihole, traefik; playbooks: pihole.yml, traefik.yml
- site.yml excludes Debian containers from Arch-specific common role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/pihole/tasks/main.yml

@@ -0,0 +1,58 @@
+---
+- name: Install Pi-hole dependencies
+  ansible.builtin.apt:
+    name:
+      - curl
+      - git
+      - libcap2-bin
+      - dns-root-data
+    state: present
+    update_cache: true
+
+- name: Create Pi-hole config directory
+  ansible.builtin.file:
+    path: /etc/pihole
+    state: directory
+    mode: "0755"
+
+- name: Write Pi-hole setup vars
+  ansible.builtin.template:
+    src: setupVars.conf.j2
+    dest: /etc/pihole/setupVars.conf
+    mode: "0644"
+
+- name: Check if Pi-hole is already installed
+  ansible.builtin.stat:
+    path: /usr/local/bin/pihole
+  register: pihole_binary
+
+- name: Download Pi-hole installer
+  ansible.builtin.get_url:
+    url: https://install.pi-hole.net
+    dest: /tmp/pihole-install.sh
+    mode: "0755"
+  when: not pihole_binary.stat.exists
+
+- name: Run Pi-hole unattended installer
+  ansible.builtin.command:
+    cmd: /tmp/pihole-install.sh --unattended
+    creates: /usr/local/bin/pihole
+  when: not pihole_binary.stat.exists
+
+- name: Set Pi-hole web password
+  ansible.builtin.command:
+    cmd: /usr/local/bin/pihole setpassword "{{ pihole_password }}"
+  changed_when: true
+
+- name: Set local DNS hosts in pihole.toml
+  ansible.builtin.template:
+    src: update_hosts.py.j2
+    dest: /tmp/pihole_update_hosts.py
+    mode: "0755"
+  notify: Update pihole hosts
+
+- name: Ensure pihole-FTL is running
+  ansible.builtin.service:
+    name: pihole-FTL
+    state: started
+    enabled: true