proxmox: add IPA sudo and local backdoor scripts, update bootstrap notes

- setup-ipa-sudo.sh: grants %admins group NOPASSWD sudo after ipa-client-install;
  writes admins-proxmox (pvesh/qm/pct) only when those binaries are present,
  so the same script works on PBS/PDM as well as PVE hosts
- create-local-backdoor.sh: creates a local 'pveadmin' account with SSH key
  and NOPASSWD sudo as an emergency fallback when IPA/SSSD is unavailable;
  password set via BACKDOOR_PASS env var or prompted interactively
- bootstrap.sh: appended post-IPA-enrollment reminder to the final checklist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

proxmox/scripts/bootstrap.sh

@@ -65,3 +65,9 @@ fi
 echo "  - ${SCRIPT_DIR}/create-admin-user.sh <username>   (PVE web UI account)"
 echo "  - Enable 2FA/TOTP for that user and root@pam via the web UI"
 echo "  - ${SCRIPT_DIR}/audit.sh   (verify everything above)"
+echo
+echo "  If this host will be enrolled in FreeIPA:"
+echo "    ipa-client-install --domain=sweet.home --realm=SWEET.HOME \\"
+echo "      --server=domain-controller.sweet.home --mkhomedir --ssh-trust-dns --no-ntp"
+echo "    ${SCRIPT_DIR}/setup-ipa-sudo.sh         (NOPASSWD sudo for IPA admins group)"
+echo "    ${SCRIPT_DIR}/create-local-backdoor.sh <ssh-pubkey>  (emergency local account)"