Add fence_pve STONITH for Proxmox VM power-cycle fencing

[mpeterson]

Summary

Add fence_pve as a STONITH agent alongside the existing fence_scsi. Currently only fence_scsi is configured, which revokes SCSI reservations but does not power-cycle the VM. This leaves the fenced node running with hung NFS/iSCSI sessions, causing stale connections on Talos nodes and requiring manual intervention (just restart-deployments-with-pvc).

Problem

When Pacemaker fences a NAS node via fence_scsi:

1. SCSI reservations are revoked (data integrity protected ✓)
2. But the VM stays running with hung zpool export, stale NFS kernel server, and iSCSI target remnants
3. Talos nodes hold stale iSCSI sessions to the fenced node — I/O errors until manually restarted
4. The fenced node may sit in this zombie state for hours until manually rebooted

Solution

Add fence_pve which talks to the Proxmox API to hard-stop/reboot the VM:

• fence-nas-01 → connects to pve-01, targets VMID 103
• fence-nas-02 → connects to pve-02, targets VMID 107

Both fence agents run together: fence_scsi for SCSI-level protection, fence_pve for actual VM power-cycle.

Setup steps

1. Install fence-agents-pve on both NAS nodes
2. Create Proxmox API user/token with VM.PowerMgmt + VM.Audit privileges
3. Create two STONITH resources with location constraints (each node fences the other)
4. Test with --action=status before enabling

Setup details documented in NAS install notes (section 7b).