Stage 1 base config/hardening toolset, applied and verified on pve1

Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).

Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.

Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.

scripts/disable-subscription-nag.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Install the subscription-nag patch (lib/nag-patch.sh) as a persistent
+# standalone script under /usr/local/sbin, plus an apt Post-Invoke hook that
+# re-applies it after every dpkg run - a proxmox-widget-toolkit package
+# upgrade overwrites the patched file, so without the hook the patch would
+# silently revert on the next `apt upgrade`.
+#
+# Idempotent - safe to re-run. Run as root on the PVE host.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+INSTALLED="/usr/local/sbin/pve-disable-subscription-nag.sh"
+write_if_changed "$INSTALLED" "$(cat "${SCRIPT_DIR}/lib/nag-patch.sh")"
+chmod +x "$INSTALLED"
+
+HOOK="/etc/apt/apt.conf.d/85pve-nosubnag"
+write_if_changed "$HOOK" 'DPkg::Post-Invoke { "test -x /usr/local/sbin/pve-disable-subscription-nag.sh && /usr/local/sbin/pve-disable-subscription-nag.sh || true"; };'
+
+"$INSTALLED"
+echo "Subscription nag patch installed; will reapply automatically after updates."