Stage 1 base config/hardening toolset, applied and verified on pve1

Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).

Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.

Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.

scripts/harden-ssh.sh

@@ -3,20 +3,10 @@
 # + fail2ban. Idempotent - safe to re-run. Run as root on the PVE host.
 set -euo pipefail
 
-DROPIN_DIR="/etc/ssh/sshd_config.d"
-DROPIN_FILE="${DROPIN_DIR}/99-hardening.conf"
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo "Must run as root." >&2
-    exit 1
-fi
-
-mkdir -p "$DROPIN_DIR"
-cat > "$DROPIN_FILE" <<'EOF'
-PermitRootLogin prohibit-password
-PasswordAuthentication no
-EOF
-echo "Wrote $DROPIN_FILE"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
 
 if ! authorized_keys_present=$(find /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys -type f 2>/dev/null | head -n1); then
     authorized_keys_present=""
@@ -26,6 +16,10 @@ if [ -z "$authorized_keys_present" ]; then
     echo "Add your SSH public key before disconnecting, or you'll lock yourself out." >&2
 fi
 
+mkdir -p /etc/ssh/sshd_config.d
+write_if_changed "/etc/ssh/sshd_config.d/99-hardening.conf" "PermitRootLogin prohibit-password
+PasswordAuthentication no"
+
 sshd -t
 systemctl reload sshd
 echo "sshd reloaded with key-only root login."
@@ -36,15 +30,13 @@ if ! dpkg -s fail2ban >/dev/null 2>&1; then
 fi
 
 mkdir -p /etc/fail2ban/jail.d
-cat > /etc/fail2ban/jail.d/sshd.local <<'EOF'
-[sshd]
+write_if_changed "/etc/fail2ban/jail.d/sshd.local" "[sshd]
 enabled = true
 port = ssh
 backend = systemd
 maxretry = 5
 bantime = 1h
-findtime = 10m
-EOF
+findtime = 10m"
 
 systemctl enable --now fail2ban
 systemctl restart fail2ban