add Linux admin user setup as part of node hardening

New script setup-linux-admin-user.sh creates the Linux system user,
installs an SSH authorized key, and adds the user to the sudo group.
Integrated into bootstrap.sh before harden-ssh.sh so key-based access
is in place before password authentication is disabled.

bootstrap.sh now accepts ADMIN_USER and ADMIN_SSH_KEY env vars to run
user setup and setup-admin-sudo.sh automatically at the right point.
audit.sh checks that at least one non-root user has an authorized key.
docs/04-security-hardening.md updated with the new steps and ordering.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/04-security-hardening.md

@@ -16,24 +16,31 @@ Then run `scripts/audit.sh` to verify. Order matters (matches
 | # | Item | Script | Manual step required? |
 |---|------|--------|------------------------|
 | 1 | Remove enterprise repos, switch to no-subscription | `switch-to-no-subscription-repo.sh` | no |
-| 2 | SSH: key-only root login + fail2ban | `harden-ssh.sh` | no (requires an `authorized_keys` already in place — script warns if missing) |
-| 3 | Unattended security upgrades, no auto-reboot | `setup-unattended-upgrades.sh` | no |
-| 4 | PVE firewall, default-deny, mgmt-only SSH/8006 | `deploy-firewall.sh` | needs `MGMT_CIDR` set |
-| 5 | Disable subscription nag (cosmetic) | `disable-subscription-nag.sh` | no |
-| 6 | Named PVE admin user, Administrator role | `create-admin-user.sh <username>` | yes — pick the username, change the generated password on first login |
-| 7 | 2FA/TOTP on that user and `root@pam` | — | yes — web UI only: Datacenter → Permissions → Two Factor, or user menu → TFA |
-| 8 | Verify everything above | `audit.sh` | no |
+| 2 | Linux admin user with SSH key + sudo access | `setup-linux-admin-user.sh <user> <pubkey>` | yes — choose a username and provide your SSH public key. Run this **before** SSH hardening or pass `ADMIN_USER`/`ADMIN_SSH_KEY` to `bootstrap.sh` so it runs automatically at the right point |
+| 3 | Passwordless sudo for pvesh/qm/pct | `setup-admin-sudo.sh <username>` | yes — same username as step 2 |
+| 4 | SSH: key-only root login + fail2ban | `harden-ssh.sh` | no — step 2 ensures authorized_keys are in place first |
+| 5 | Unattended security upgrades, no auto-reboot | `setup-unattended-upgrades.sh` | no |
+| 6 | PVE firewall, default-deny, mgmt-only SSH/8006 | `deploy-firewall.sh` | needs `MGMT_CIDR` set |
+| 7 | Disable subscription nag (cosmetic) | `disable-subscription-nag.sh` | no |
+| 8 | Named PVE admin user, Administrator role | `create-admin-user.sh <username>` | yes — pick the username, change the generated password on first login |
+| 9 | 2FA/TOTP on that user and `root@pam` | — | yes — web UI only: Datacenter → Permissions → Two Factor, or user menu → TFA |
+| 10 | Verify everything above | `audit.sh` | no |
 
 ## Linux/SSH layer
 
+- A named Linux system user (created by `setup-linux-admin-user.sh`) with an
+  SSH authorized key and `sudo` group membership is the primary SSH login
+  account. Root SSH is locked to key-only after `harden-ssh.sh` runs; the
+  Linux admin user is how you get shell access day-to-day without using root.
+- `setup-admin-sudo.sh` adds a narrower, password-free sudoers rule for the
+  Proxmox management tools (`pvesh`, `qm`, `pct`) specifically — needed for
+  non-interactive automation scripts that SSH in and run these tools without a
+  TTY.
 - `PermitRootLogin prohibit-password` in `sshd_config` — root can only
   log in via SSH key, never password. Kills most brute-force attempts.
 - fail2ban jail for SSH on top of that.
 - Restrict SSH to the management VLAN/trusted IPs via the Proxmox
   firewall (see `03-networking.md`) rather than exposing broadly.
-- A separate Linux sudo user isn't strictly required for day-to-day PVE
-  admin (the PVE permission system below governs that), but worth adding
-  if multiple people SSH into the box directly, for accountability.
 
 ## PVE/web layer (the one that actually matters day-to-day)