feat(fastpass): Talos cluster provisioning and bootstrap

- Terraform: VM provisioning, Unifi DHCP, Technitium DNS
- talhelper: cluster config for 6-node Talos cluster
- Cilium 1.19.4 CNI with Talos-compatible security context
- docs: city-hall setup guide and bootstrap runbook

terraform/talos/cluster/tfvars/fastpass.tfvars.example

@@ -0,0 +1,40 @@
+# ─── fastpass Cluster — Variable Values ──────────────────────────────────────
+# Copy to fastpass.tfvars and populate.
+# Sensitive values (passwords, tokens) are passed via CLI or environment:
+#
+#   terraform apply \
+#     -var-file="tfvars/fastpass.tfvars" \
+#     -state="states/fastpass.tfstate" \
+#     -var="proxmox_api_token=terraform@pve!terraform-token=<secret>" \
+#     -var="unifi_password=<secret>" \
+#     -var="technitium_password=<secret>"
+
+# ─── Proxmox ─────────────────────────────────────────────────────────────────
+proxmox_api_url   = "https://fantasyland.local.mk-labs.cloud:8006"
+proxmox_api_token = "terraform@pve!terraform-token=REPLACE_ME"
+
+# ─── Unifi ───────────────────────────────────────────────────────────────────
+unifi_api_url    = "https://10.1.71.1"
+unifi_username   = "terraform"
+unifi_password   = "REPLACE_ME"
+# Retrieve with: curl -sk -X GET https://10.1.71.1/api/network | jq '.data[] | select(.name=="Server Trusted") | ._id'
+unifi_network_id = "REPLACE_ME"
+
+# ─── Technitium DNS ───────────────────────────────────────────────────────────
+technitium_url      = "http://10.1.71.32:5380"
+technitium_username = "admin"
+technitium_password = "REPLACE_ME"
+
+# ─── Cluster ─────────────────────────────────────────────────────────────────
+cluster_name  = "fastpass"
+talos_version = "v1.9.5"
+dns_zone      = "local.mk-labs.cloud"
+
+# ─── ISO ─────────────────────────────────────────────────────────────────────
+iso_node      = "fantasyland"
+iso_datastore = "local"
+
+# ─── VM Defaults ─────────────────────────────────────────────────────────────
+datastore = "liberty-tree"
+bridge    = "vmbr0"
+vlan_id   = 71