feat(fastpass): Talos cluster provisioning and bootstrap

- Terraform: VM provisioning, Unifi DHCP, Technitium DNS
- talhelper: cluster config for 6-node Talos cluster
- Cilium 1.19.4 CNI with Talos-compatible security context
- docs: city-hall setup guide and bootstrap runbook

terraform/talos/cluster/variables.tf

@@ -0,0 +1,79 @@
+# ─── Proxmox Authentication ──────────────────────────────────────────────────
+
+variable "proxmox_api_url" {
+  type        = string
+  description = "Proxmox API endpoint URL (e.g., https://fantasyland.local.mk-labs.cloud:8006)."
+}
+
+variable "proxmox_api_token" {
+  type        = string
+  description = "Proxmox API token. Format: user@realm!token-name=token-secret."
+  sensitive   = true
+}
+
+# ─── Unifi Authentication ────────────────────────────────────────────────────
+
+variable "unifi_api_url" {
+  type        = string
+  description = "Unifi controller API URL (e.g., https://10.1.71.1:443)."
+}
+
+variable "unifi_username" {
+  type        = string
+  description = "Unifi controller username."
+}
+
+variable "unifi_password" {
+  type        = string
+  description = "Unifi controller password."
+  sensitive   = true
+}
+
+# ─── Technitium DNS Authentication ───────────────────────────────────────────
+
+variable "technitium_url" {
+  type        = string
+  description = "Technitium DNS server URL (e.g., http://10.1.71.32:5380)."
+}
+
+variable "technitium_api_token" {
+  type        = string
+  description = "Technitium API token. Create under Administration → API Tokens."
+  sensitive   = true
+}
+
+# ─── Cluster Configuration ───────────────────────────────────────────────────
+
+variable "cluster_name" {
+  type        = string
+  description = "Talos cluster name."
+  default     = "fastpass"
+}
+
+variable "dns_zone" {
+  type        = string
+  description = "Internal DNS zone for A record creation."
+  default     = "local.mk-labs.cloud"
+}
+
+# ─── ISO Storage ─────────────────────────────────────────────────────────────
+
+variable "iso_datastore" {
+  type        = string
+  description = "Proxmox datastore for ISO storage. Must be visible to all nodes — use a shared/Ceph-backed datastore, not node-local storage."
+  default     = "templates"
+}
+
+# ─── Shared VM Defaults ──────────────────────────────────────────────────────
+
+variable "datastore" {
+  type        = string
+  description = "Proxmox storage pool for VM disks."
+  default     = "liberty-tree"
+}
+
+variable "bridge" {
+  type        = string
+  description = "Proxmox network bridge."
+  default     = "vmbr0"
+}