add setup-admin-sudo.sh for passwordless Proxmox tool access

The nixos flake's create-proxmox-resource.sh runs pvesh/qm/pct over
non-interactive SSH, which requires NOPASSWD sudo for those binaries.
pvesh moved from /usr/sbin to /usr/bin in PVE 8.x, so the script
resolves paths at runtime rather than hardcoding them, preventing the
silent NOPASSWD-miss that caused ipcc_send_rec errors.

- scripts/setup-admin-sudo.sh: new script, takes username, writes
  /etc/sudoers.d/<user>-proxmox with correct resolved paths and
  validates it with visudo -c before leaving it in place
- scripts/bootstrap.sh: add setup-admin-sudo.sh to post-steps list
- scripts/audit.sh: check that a *-proxmox sudoers file exists with
  NOPASSWD for all three tools

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/audit.sh

@@ -76,6 +76,23 @@ else
     audit_fail "no named @pve user found - root@pam is the only account"
 fi
 
+# --- passwordless sudo for pvesh/qm/pct ---
+# The nixos flake's create-proxmox-resource.sh runs pvesh/qm/pct over
+# non-interactive SSH, so the admin user needs NOPASSWD for these tools.
+SUDO_OK=0
+for f in /etc/sudoers.d/*-proxmox; do
+    [ -f "$f" ] || continue
+    if grep -qE 'NOPASSWD:.*pvesh' "$f" && grep -qE 'NOPASSWD:.*\bqm\b' "$f" && grep -qE 'NOPASSWD:.*\bpct\b' "$f"; then
+        SUDO_OK=1
+        break
+    fi
+done
+if [ "$SUDO_OK" -eq 1 ]; then
+    audit_pass "admin user has NOPASSWD sudo for pvesh/qm/pct"
+else
+    audit_fail "no sudoers file grants NOPASSWD for pvesh/qm/pct (run setup-admin-sudo.sh <username>)"
+fi
+
 # --- time sync ---
 if timedatectl show -p NTPSynchronized --value 2>/dev/null | grep -qx 'yes'; then
     audit_pass "clock is NTP-synchronized"