Add Pi-hole and Traefik LXC containers

- LXC 103 (pihole): Debian 12, 10.10.1.2, Pi-hole v6 with local DNS for
  gitea/grafana/traefik/pihole.homelab, Proxmox dnsmasq updated to use
  Pi-hole upstream
- LXC 104 (traefik): Debian 12, 10.10.1.3, Traefik v3 routing
  gitea.homelab → 10.10.1.125:3000, grafana.homelab → 10.10.1.137:3000
- DNAT rules on vmbr0 forwarding :80/:443 to Traefik, persisted in
  /etc/network/interfaces
- Ansible roles: pihole, traefik; playbooks: pihole.yml, traefik.yml
- site.yml excludes Debian containers from Arch-specific common role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/traefik/defaults/main.yml

@@ -0,0 +1,17 @@
+---
+traefik_version: "3.3.4"
+traefik_http_port: 80
+traefik_https_port: 443
+traefik_dashboard_port: 8080
+traefik_log_level: "INFO"
+
+traefik_services:
+  - name: gitea
+    host: "gitea.homelab"
+    backend: "http://10.10.1.125:3000"
+  - name: grafana
+    host: "grafana.homelab"
+    backend: "http://10.10.1.137:3000"
+  - name: pihole
+    host: "pihole.homelab"
+    backend: "http://10.10.1.2:80"