Add Pi-hole and Traefik LXC containers

- LXC 103 (pihole): Debian 12, 10.10.1.2, Pi-hole v6 with local DNS for
  gitea/grafana/traefik/pihole.homelab, Proxmox dnsmasq updated to use
  Pi-hole upstream
- LXC 104 (traefik): Debian 12, 10.10.1.3, Traefik v3 routing
  gitea.homelab → 10.10.1.125:3000, grafana.homelab → 10.10.1.137:3000
- DNAT rules on vmbr0 forwarding :80/:443 to Traefik, persisted in
  /etc/network/interfaces
- Ansible roles: pihole, traefik; playbooks: pihole.yml, traefik.yml
- site.yml excludes Debian containers from Arch-specific common role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/pihole/templates/update_hosts.py.j2

@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+import re
+
+hosts = [
+{% for h in pihole_dns_hosts %}
+    "{{ h.ip }} {{ h.host }}",
+{% endfor %}
+]
+
+hosts_str = "[" + ", ".join('"' + h + '"' for h in hosts) + "]"
+
+with open("/etc/pihole/pihole.toml", "r") as f:
+    content = f.read()
+
+content = re.sub(
+    r"(?m)^( *hosts\s*=\s*)\[.*\]",
+    r"\g<1>" + hosts_str,
+    content,
+)
+
+with open("/etc/pihole/pihole.toml", "w") as f:
+    f.write(content)