Add pve1->pve-test VM/CT migration script (vzdump + qmrestore pattern)

Reuses the clone script's vzdump/relay/restore flow but as a move rather
than a copy: preserves the original MAC by default, adds a stop-source/
start-target cutover step, and an opt-in --remove-source to destroy the
source guest afterward. Not a true qm migrate (nodes aren't clustered),
so the default --mode snapshot has a documented write gap between
snapshot and cutover; --mode stop avoids it at the cost of downtime.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013Lkv8k24Wuua3GRxrfMBLz

CLAUDE.md

@@ -256,6 +256,33 @@ lift the shared part into `scripts/lib/` instead of copying it.
   `/etc/ssh/ssh_known_hosts`. Idempotent (re-running replaces its own
   marked block rather than duplicating it); restarts `nix-daemon` by
   default so the change takes effect immediately.
+- `scripts/proxmox/clone-pve1-to-pve-test.sh --vmid <n> [options]` — ad hoc
+  copy of a single VM/CT from one node to another via `vzdump` +
+  `qmrestore`/`pct restore`, relayed through this machine
+  (`ssh src cat ... | ssh dst cat > ...`, no on-disk staging copy).
+  Defaults `pve1` → `pve-test` (see "Two Proxmox nodes" above); source is
+  left running throughout (`--mode snapshot` default) and untouched
+  beyond the vzdump + a typed-VMID confirm, restored on the target with a
+  fresh MAC (`--unique 1`, always) since the source is expected to still
+  be live on the same LAN. Backup archives are deleted from both nodes
+  afterward unless `--keep-backup`. `--dry-run` throughout.
+- `scripts/proxmox/migrate-vm.sh --vmid <n> [options]` — moves (rather
+  than clones) a single VM/CT between nodes, built on the same
+  vzdump/relay/restore pattern as `clone-pve1-to-pve-test.sh` above, plus
+  a cutover step (stop the guest on the source node, start it on the
+  target) and, optionally, `--remove-source` to destroy it on the source
+  node afterward (its own separate typed confirmation, since that step is
+  irreversible) — the default instead leaves the stopped source guest
+  intact as a safety net. Restores with the *original* MAC (no
+  `--unique`) unless `--unique` is passed, since the source is expected to
+  go away rather than keep running alongside the target. **Not** a true
+  `qm migrate`-style live migration — pve1/pve-test aren't a clustered
+  pair with shared storage, so this is vzdump-based and, with the default
+  `--mode snapshot`, any writes on the source between the snapshot and
+  cutover are lost (use `--mode stop` if that's not acceptable). Generic
+  node-to-node (not pve1/pve-test-specific) via
+  `--source-node`/`--target-node`, defaulting to pve1 → pve-test like the
+  clone script. `--dry-run` throughout.
 
 ### `scripts/lib/`