proxmox: allow beszel agent port 45876 from mgmt network

Adds an inbound ACCEPT rule for TCP 45876 so the beszel hub
can poll the agent running on pve1. Scoped to +mgmt (192.168.2.0/24)
to stay consistent with the existing default-deny policy.

Rule applied live on pve1 via pve-firewall restart (2026-07-24).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

proxmox/config/pve-firewall/cluster.fw.example

@@ -33,6 +33,9 @@ IN ACCEPT -source +mgmt -p tcp -dport 22 -log nolog
 # docs/06-pve-test-wifi-network.md for a case this caused real confusion.
 IN ACCEPT -source +mgmt -p icmp -icmp-type echo-request -log nolog
 
+# Beszel monitoring agent - the hub polls the agent on this port
+IN ACCEPT -source +mgmt -p tcp -dport 45876 -log nolog
+
 # Stage 2: Corosync (cluster quorum) - uncomment once node 2/3 join and
 # the corosync network/VLAN exists.
 # IN ACCEPT -source <COROSYNC_CIDR> -p udp -dport 5404:5405 -log nolog