feat(tofu): OpenTofu provisioning scaffold, auth modes and pilot notes

- providers.tf / variables.tf / versions.tf: bpg/proxmox ~> 0.84, endpoint and
  credentials from TF_VAR_* (set by the Makefile tofu-* targets from the
  repo-root .env). Two auth modes: root@pam by password (privileged: features
  beyond nesting, device passthrough, datastore mount points) or the
  ansible@pve token.
- README.md: pilot results on VMID 199 - what the token can and cannot do,
  why a root token still fails the literal `$authuser eq 'root@pam'` check,
  the cmode/console drift finding, and the chosen root@pam-by-password mode.
- pilot.tf.example: reference resource shape (features, device_passthrough,
  mount_point), not loaded (.example).
- .terraform.lock.hcl: pin the provider.

State has no backend yet; tofu/*.tfstate stays local and git-ignored.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

tofu/providers.tf

@@ -0,0 +1,11 @@
+provider "proxmox" {
+  endpoint = var.pve_endpoint
+  insecure = var.pve_insecure
+
+  # null вместо пустой строки принципиален: провайдер выбирает способ
+  # аутентификации по тому, какие поля заданы, и пустая строка считалась бы
+  # заданным значением.
+  api_token = var.pve_api_token != "" ? var.pve_api_token : null
+  username  = var.pve_username != "" ? var.pve_username : null
+  password  = var.pve_password != "" ? var.pve_password : null
+}