restructure: move proxmox/ into subfolder, add pihole/ section

All existing content moved from repo root into proxmox/ to make room
for other Debian machine configs. Adds pihole/ with:

- config/pihole.toml — snapshot of current Pi-hole v6 config
- config/dnsmasq.d/99-ipxe-chainload.conf — custom PXE DHCP rules
  (EFI/BIOS iPXE chainload, fixed tag-specificity bug for UEFI boot)
- pull-config.sh <source-host> <dest-dir> — pull live config to disk
- apply-config.sh <source-dir> <dest-host> — push config to a Pi-hole

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

proxmox/scripts/lib/common.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# Shared helpers for proxmox-configuration scripts. Sourced, not executed
+# directly:
+#   SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+#   source "${SCRIPT_DIR}/lib/common.sh"
+
+require_root() {
+    if [ "$(id -u)" -ne 0 ]; then
+        echo "Must run as root." >&2
+        exit 1
+    fi
+}
+
+# Codename of the running Debian/PVE release, e.g. "trixie".
+pve_codename() {
+    (. /etc/os-release && echo "$VERSION_CODENAME")
+}
+
+# backup_file <path>
+# Copies an existing file to <path>.bak.<epoch>. No-op if it doesn't exist.
+backup_file() {
+    local path="$1"
+    if [ -f "$path" ]; then
+        cp "$path" "${path}.bak.$(date +%s)"
+        echo "Backed up ${path}"
+    fi
+}
+
+# write_if_changed <path> <content>
+# Writes content to path only if it differs from what's already there,
+# backing up the previous version first. Prints what happened.
+write_if_changed() {
+    local path="$1" content="$2"
+    if [ -f "$path" ] && [ "$(cat "$path")" = "$content" ]; then
+        echo "Already up to date: $path"
+        return 0
+    fi
+    backup_file "$path"
+    printf '%s\n' "$content" > "$path"
+    echo "Wrote $path"
+}
+
+# --- audit.sh status helpers ---
+# Callers should initialize: AUDIT_FAIL=0
+audit_pass() { echo "PASS  $1"; }
+audit_fail() { echo "FAIL  $1"; AUDIT_FAIL=1; }
+audit_warn() { echo "WARN  $1"; }

proxmox/scripts/lib/nag-patch.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# Neutralizes the Proxmox "No valid subscription" nag (login popup and the
+# dashboard subscription indicator) by patching proxmox-widget-toolkit's
+# proxmoxlib.js. Cosmetic only - doesn't create or spoof a subscription
+# anywhere except this UI check.
+#
+# This file is not run from the repo directly - disable-subscription-nag.sh
+# installs a copy of it to /usr/local/sbin and wires it into an apt
+# Post-Invoke hook, because a proxmox-widget-toolkit package upgrade
+# overwrites proxmoxlib.js and reverts the patch. Idempotent: exits quietly
+# if already patched or if the file isn't present.
+set -euo pipefail
+
+JS_FILE="/usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js"
+[ -f "$JS_FILE" ] || exit 0
+
+PATTERN="data.status.toLowerCase() !== 'active'"
+grep -qF "$PATTERN" "$JS_FILE" || exit 0
+
+cp "$JS_FILE" "${JS_FILE}.bak.$(date +%s)"
+sed -i "s/${PATTERN}/false/g" "$JS_FILE"
+echo "Patched subscription nag in $JS_FILE"