feat: migrate all managed LXC provisioning to OpenTofu (blue-green)

Blue-green: a new container is created beside the old one, data is copied, the
IP is moved onto it, and the old container is kept stopped as rollback for at
least a week. Keeping the IP means only the VMID changes, and its consumers
(backup jobs, backup audit) already derive it from the registry.

Batch 1 (2026-09-02): emergency-bot 148->151, docker-test 145->152,
gitea 141->153, vaultwarden 140->154, monitoring 146->155, gyro 150->156,
grimmory 149->157.
Batch 2 (2026-09-03): adguard 144->158, mihomo 143->159, ovpn-mini 132->160.
All migratable LXC are now provisioner: tofu. hermes-ai (frozen) and pbs stay.

- tofu/services.tf + tofu/svc-*.tf: one resource per service, reproducing the
  pct-config etalon. /dev/fuse -> features.fuse; /dev/net/tun ->
  device_passthrough (first live use on mihomo and ovpn-mini); gitea bind mount
  -> datastore volume (data finally reaches PBS); console { type = "shell" }
  declared explicitly (provider tracks cmode there).
- services.yml: vmid + provisioner: tofu for every migrated service; features
  strings and device notes updated to the tofu representation; also drops the
  memoir-bot entry and adds homelab_reverse_proxy_image/_unit.
- pve-*.yml: configuration play target is `{{ pve_config_target | default(...) }}`
  so it can run against <name>-new on a temp address (a bare --limit zeroes the
  play instead of retargeting it). Container-creation plays are gated behind
  `provisioner != 'tofu'` / `pve_provisioning_enabled` (meta: end_play), so a
  stray run cannot pct start a stopped OLD VMID on a live IP. Override for
  intentional legacy rollback: -e pve_<svc>_legacy_provisioning_enabled=true.
- ssh_config: drop memoir-bot; ovpn-mini gets ProxyJump none (a jump via ru-vps
  would route through the very tunnel ovpn-mini terminates).
- gyro.yml / uptime-kuma.yml: same pve_config_target override.
- roles/uptime_kuma: only freeze homelab-monitoring when the unit actually
  exists (a fresh blue-green container never had it).
- offsite-restic-yadisk.yml: the gitea restic profile now runs inside the LXC
  (hosts: gitea), since the bind-mount host path is gone after the volume move;
  lost+found excluded (unreadable in an unprivileged LXC, restic exit 3).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

tofu/svc-vaultwarden.tf

@@ -0,0 +1,109 @@
+# ============================================================================
+# Сервис №4: vaultwarden (OLD vmid 140, mini-pc).
+# Эталон снят 2026-09-02: ssh mini-pc sudo pct config 140 / cat /etc/pve/lxc/140.conf.
+# Данные критичны: SQLite /opt/vaultwarden/data/db.sqlite3 (плюс config.json,
+# rsa_key.pem, icon_cache/). Переносятся вручную на шаге 4.4, а не этим
+# ресурсом — контейнер создаётся пустым, данные переезжают отдельной
+# процедурой (см. docs/ai/migration-tofu.md, п.5.4).
+#
+# vm_id 154. TMPIP 192.168.1.13 отработал на шагах 4.3 и 4.4; cutover выполнен
+# 2026-09-02, адрес боевой — 192.168.1.24. Данные перенесены и сверены:
+# integrity_check ok, 1 users / 314 ciphers совпали с боевыми.
+# OLD (140) остановлен и остаётся откатом минимум неделю, до 2026-09-09
+# (docs/ai/migration-tofu.md, инвариант №2).
+# ============================================================================
+
+resource "proxmox_virtual_environment_container" "vaultwarden" {
+  node_name     = "mini-pc"
+  vm_id         = 154
+  unprivileged  = true
+  start_on_boot = true
+  started       = true
+  tags          = ["tofu"]
+
+  initialization {
+    hostname = "vaultwarden"
+
+    ip_config {
+      ipv4 {
+        address = "192.168.1.24/24"
+        gateway = "192.168.1.1"
+      }
+    }
+
+    dns {
+      servers = ["1.1.1.1"]
+    }
+
+    user_account {
+      keys = [trimspace(file(pathexpand("~/.ssh/id_ed25519_homelab.pub")))]
+    }
+  }
+
+  operating_system {
+    template_file_id = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
+    type             = "debian"
+  }
+
+  cpu {
+    cores = 2
+  }
+
+  memory {
+    dedicated = 1024
+    swap      = 512
+  }
+
+  disk {
+    datastore_id = "local-lvm"
+    size         = 16
+  }
+
+  # Эталон: features: nesting=1,keyctl=1 плюс /dev/fuse, проброшенный вручную
+  # двумя строками в /etc/pve/lxc/140.conf (lxc.cgroup2.devices.allow c 10:229
+  # rwm + lxc.mount.entry) — Proxmox API сырые lxc.* ключи не принимает,
+  # поэтому pve-vaultwarden.yml добавляет их через lineinfile.
+  #
+  # ЗАМЕНА ЭТОГО ОБХОДА — features.fuse, а НЕ device_passthrough.
+  # device_passthrough (dev0:) нужен только для сырых character-устройств
+  # вида /dev/net/tun. Для /dev/fuse у PVE есть штатный флаг, и именно он
+  # проверен на пилоте VMID 199 — результат был
+  # `features: fuse=1,keyctl=1,nesting=1`, см. tofu/pilot.tf.example:17-21
+  # и tofu/README.md. Формулировка «device_passthrough для каждого устройства»
+  # в migration-tofu.md п.4.2 слишком широкая; она уточнена там же.
+  #
+  # Следствие: pct config нового контейнера покажет
+  # `features: fuse=1,keyctl=1,nesting=1` — текстуально иначе, чем эталон,
+  # но это тот же эффект штатным механизмом вместо обхода.
+  features {
+    nesting = true
+    keyctl  = true
+    fuse    = true
+  }
+
+  # roles/pve_lxc всем контейнерам ставит cmode=shell (pve_lxc_cmode), провайдер
+  # это отслеживает через блок console.type — без него на следующем apply
+  # откатит на дефолт Proxmox tty (найдено на emergency-bot, см. tofu/README.md).
+  console {
+    type = "shell"
+  }
+
+  network_interface {
+    name     = "eth0"
+    bridge   = "vmbr0"
+    firewall = true
+  }
+
+  startup {
+    order = 40
+  }
+}
+
+output "vaultwarden" {
+  description = "Что проверять на узле после apply"
+  value = {
+    vmid   = proxmox_virtual_environment_container.vaultwarden.vm_id
+    node   = proxmox_virtual_environment_container.vaultwarden.node_name
+    verify = "ssh mini-pc sudo pct config ${proxmox_virtual_environment_container.vaultwarden.vm_id}"
+  }
+}