add setup-admin-sudo.sh for passwordless Proxmox tool access

The nixos flake's create-proxmox-resource.sh runs pvesh/qm/pct over
non-interactive SSH, which requires NOPASSWD sudo for those binaries.
pvesh moved from /usr/sbin to /usr/bin in PVE 8.x, so the script
resolves paths at runtime rather than hardcoding them, preventing the
silent NOPASSWD-miss that caused ipcc_send_rec errors.

- scripts/setup-admin-sudo.sh: new script, takes username, writes
  /etc/sudoers.d/<user>-proxmox with correct resolved paths and
  validates it with visudo -c before leaving it in place
- scripts/bootstrap.sh: add setup-admin-sudo.sh to post-steps list
- scripts/audit.sh: check that a *-proxmox sudoers file exists with
  NOPASSWD for all three tools

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/bootstrap.sh

@@ -41,5 +41,6 @@ echo "=== 5/5: disable subscription nag (cosmetic) ==="
 echo
 echo "=== Base hardening applied. Remaining manual/deliberate steps: ==="
 echo "  - ${SCRIPT_DIR}/create-admin-user.sh <username>"
+echo "  - ${SCRIPT_DIR}/setup-admin-sudo.sh <username>   (passwordless sudo for pvesh/qm/pct)"
 echo "  - Enable 2FA/TOTP for that user and root@pam via the web UI"
 echo "  - ${SCRIPT_DIR}/audit.sh   (verify everything above)"