restructure: move proxmox/ into subfolder, add pihole/ section

All existing content moved from repo root into proxmox/ to make room
for other Debian machine configs. Adds pihole/ with:

- config/pihole.toml — snapshot of current Pi-hole v6 config
- config/dnsmasq.d/99-ipxe-chainload.conf — custom PXE DHCP rules
  (EFI/BIOS iPXE chainload, fixed tag-specificity bug for UEFI boot)
- pull-config.sh <source-host> <dest-dir> — pull live config to disk
- apply-config.sh <source-dir> <dest-host> — push config to a Pi-hole

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

proxmox/config/pve-firewall/cluster.fw.example

@@ -0,0 +1,44 @@
+# Example cluster-wide firewall rules for /etc/pve/firewall/cluster.fw
+#
+# Stage 1 (single host, current): only the mgmt IPSET applies. Applied
+# automatically by scripts/deploy-firewall.sh, which fills in <MGMT_CIDR>.
+#
+# Stage 2 (future cluster/Ceph): the corosync and Ceph rules below are
+# commented out placeholders. Uncomment and fill in <COROSYNC_CIDR> /
+# <CEPH_CIDR> when nodes 2/3 join and those networks actually exist -
+# leaving them active on a single node with no corosync/Ceph traffic is
+# just dead config, and a literal `<COROSYNC_CIDR>` is invalid syntax if
+# left uncommented and unfilled.
+#
+# Copy to /etc/pve/firewall/cluster.fw and edit before enabling (or use
+# scripts/deploy-firewall.sh).
+
+[OPTIONS]
+enable: 1
+policy_in: DROP
+policy_out: ACCEPT
+
+[IPSET mgmt]
+<MGMT_CIDR>
+
+[RULES]
+# Web UI + SSH only from the management network
+IN ACCEPT -source +mgmt -p tcp -dport 8006 -log nolog
+IN ACCEPT -source +mgmt -p tcp -dport 22 -log nolog
+
+# ICMP echo (ping) from the management network - diagnostic convenience
+# only, nothing else depends on it. Without this, policy_in DROP silently
+# eats ping while SSH/web UI keep working - looks like an outage during
+# troubleshooting when the host is actually fine. See
+# docs/06-pve-test-wifi-network.md for a case this caused real confusion.
+IN ACCEPT -source +mgmt -p icmp -icmp-type echo-request -log nolog
+
+# Stage 2: Corosync (cluster quorum) - uncomment once node 2/3 join and
+# the corosync network/VLAN exists.
+# IN ACCEPT -source <COROSYNC_CIDR> -p udp -dport 5404:5405 -log nolog
+
+# Stage 2: Ceph (uncomment once Ceph is live; ports: mon 3300,6789,
+# osd/mgr/mds 6800-7300)
+# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 3300 -log nolog
+# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 6789 -log nolog
+# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 6800:7300 -log nolog