add Linux admin user setup as part of node hardening

New script setup-linux-admin-user.sh creates the Linux system user,
installs an SSH authorized key, and adds the user to the sudo group.
Integrated into bootstrap.sh before harden-ssh.sh so key-based access
is in place before password authentication is disabled.

bootstrap.sh now accepts ADMIN_USER and ADMIN_SSH_KEY env vars to run
user setup and setup-admin-sudo.sh automatically at the right point.
audit.sh checks that at least one non-root user has an authorized key.
docs/04-security-hardening.md updated with the new steps and ordering.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/audit.sh

@@ -69,6 +69,22 @@ if [ -f /var/run/reboot-required ]; then
     audit_warn "a reboot is pending (/var/run/reboot-required) - schedule one"
 fi
 
+# --- Linux admin user with SSH key (for non-root SSH login) ---
+LINUX_ADMIN_OK=0
+for auth_file in /home/*/.ssh/authorized_keys; do
+    [ -f "$auth_file" ] || continue
+    # Must have at least one non-comment, non-empty key line.
+    if grep -qE '^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp[0-9]+) ' "$auth_file" 2>/dev/null; then
+        LINUX_ADMIN_OK=1
+        break
+    fi
+done
+if [ "$LINUX_ADMIN_OK" -eq 1 ]; then
+    audit_pass "a non-root Linux user has an SSH authorized key"
+else
+    audit_fail "no non-root Linux user has an authorized SSH key (run setup-linux-admin-user.sh)"
+fi
+
 # --- named admin user (not just root@pam) ---
 if pveum user list --output-format json 2>/dev/null | grep -q '"userid":"[^"]*@pve"'; then
     audit_pass "a named @pve admin user exists (root@pam is not the only account)"