proxmox: add IPA sudo and local backdoor scripts, update bootstrap notes

- setup-ipa-sudo.sh: grants %admins group NOPASSWD sudo after ipa-client-install;
  writes admins-proxmox (pvesh/qm/pct) only when those binaries are present,
  so the same script works on PBS/PDM as well as PVE hosts
- create-local-backdoor.sh: creates a local 'pveadmin' account with SSH key
  and NOPASSWD sudo as an emergency fallback when IPA/SSSD is unavailable;
  password set via BACKDOOR_PASS env var or prompted interactively
- bootstrap.sh: appended post-IPA-enrollment reminder to the final checklist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

proxmox/scripts/setup-ipa-sudo.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Grant the IPA 'admins' group passwordless sudo on this host.
+#
+# Writes two files:
+#   /etc/sudoers.d/admins-nopasswd  -- NOPASSWD: ALL for general shell use
+#   /etc/sudoers.d/admins-proxmox   -- NOPASSWD for pvesh/qm/pct (PVE only;
+#                                      skipped silently if those binaries
+#                                      aren't present, e.g. on PBS/PDM)
+#
+# Idempotent - safe to re-run. Run as root on the target host after
+# ipa-client-install has been completed and SSSD is active.
+#
+# Usage: ./setup-ipa-sudo.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+if [ ! -f /etc/ipa/default.conf ]; then
+    echo "ERROR: /etc/ipa/default.conf not found -- is this host enrolled in FreeIPA?" >&2
+    exit 1
+fi
+
+write_if_changed /etc/sudoers.d/admins-nopasswd '%admins ALL=(root) NOPASSWD: ALL'
+chmod 0440 /etc/sudoers.d/admins-nopasswd
+
+# PVE-specific tools -- pvesh moved from /usr/sbin to /usr/bin in PVE 8.x;
+# resolve at script time so the path in the sudoers rule is always correct.
+PVESH="$(command -v pvesh 2>/dev/null || true)"
+QM="$(command -v qm 2>/dev/null || true)"
+PCT="$(command -v pct 2>/dev/null || true)"
+
+if [ -n "$PVESH" ] && [ -n "$QM" ] && [ -n "$PCT" ]; then
+    write_if_changed /etc/sudoers.d/admins-proxmox \
+        "%admins ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}"
+    chmod 0440 /etc/sudoers.d/admins-proxmox
+    echo "Proxmox tools found -- wrote admins-proxmox."
+else
+    echo "pvesh/qm/pct not found -- skipping admins-proxmox (not a PVE host)."
+fi
+
+visudo -c >/dev/null
+echo "All sudoers files valid. IPA admins group has sudo on this host."