feat(fastpass): Talos cluster provisioning and bootstrap

- Terraform: VM provisioning, Unifi DHCP, Technitium DNS
- talhelper: cluster config for 6-node Talos cluster
- Cilium 1.19.4 CNI with Talos-compatible security context
- docs: city-hall setup guide and bootstrap runbook

terraform/talos/cluster/outputs.tf

@@ -0,0 +1,43 @@
+# ─── Post-Apply Reminders ────────────────────────────────────────────────────
+
+output "ha_rule_instructions" {
+  description = "Manual steps required after the Talos cluster is fully installed and the ISO is no longer needed."
+  value       = <<-EOT
+
+    ── Post-Cluster-Install: HA Setup ──────────────────────────────────────────
+
+    Once Talos is fully installed and running (ISO no longer needed for boot),
+    complete the following steps:
+
+    1. Register each VM with the Proxmox HA manager:
+       ha-manager add vm:71066 --state started
+       ha-manager add vm:71067 --state started
+       ha-manager add vm:71068 --state started
+       ha-manager add vm:71069 --state started
+       ha-manager add vm:71070 --state started
+       ha-manager add vm:71071 --state started
+
+    2. Add VMs to the existing node-affinity rules (check current resources
+       first with pvesh get /cluster/ha/rules/<rule>):
+
+       prefer_main-street-usa (space-mountain:71066, jungle-cruise:71069):
+         pvesh set /cluster/ha/rules/prefer_main-street-usa \
+           --type node-affinity \
+           --resources "<existing>,vm:71066,vm:71069"
+
+       prefer_tomorrowland (big-thunder-mountain:71067, haunted-mansion:71070):
+         pvesh set /cluster/ha/rules/prefer_tomorrowland \
+           --type node-affinity \
+           --resources "<existing>,vm:71067,vm:71070"
+
+       prefer_fantasyland (splash-mountain:71068, peter-pans-flight:71071):
+         pvesh set /cluster/ha/rules/prefer_fantasyland \
+           --type node-affinity \
+           --resources "<existing>,vm:71068,vm:71071"
+
+    3. Eject the Talos ISO from each VM in the Proxmox UI or via:
+       qm set <vmid> --ide2 none
+
+    ────────────────────────────────────────────────────────────────────────────
+  EOT
+}