feat(ansible): add corosync-qnetd role for NAS quorum

[mpeterson]

What

Adds a lightweight Ansible role and playbook to provision the corosync-qnetd quorum device on a dedicated VM (qnetd-01, IP 10.3.25.13).

This provides a third vote for the 2-node NAS cluster (zfs-cluster), enabling proper majority quorum (2 of 3) instead of relying on two_node: 1 mode with no-quorum-policy=ignore.

Components

File	Purpose
ansible/roles/corosync_qnetd/defaults/main.yaml	Role variables (port 5403, cert paths, ffsplit algorithm)
ansible/roles/corosync_qnetd/tasks/main.yaml	Install corosync-qnetd, firewall rules, NSS cert init, enable service
ansible/roles/corosync_qnetd/handlers/main.yaml	Restart handler
ansible/playbooks/corosync_qnetd/setup.yaml	Playbook targeting the qnetd host group
ansible/sample_inventory/qnetd.yaml	Sample inventory for the qnetd host
ansible/playbooks/setup.yaml	Updated to import the new qnetd playbook

Deploy-time steps (not in this PR)

These must be done at the maintenance window when deploying:

1. Create VM — Manually provision AlmaLinux 9.5 minimal VM in Proxmox (1 vCPU, 512 MB RAM, 8 GB disk, NIC on 10.3.25.0/24 storage VLAN)
2. Add inventory — Create ansible/inventories/qnetd.yaml with qnetd-01.lan.peterson.com.ar (10.3.25.13)
3. DNS zone update — Add qnetd-01 IN A 10.3.25.13 to ansible/inventories/files/bind9/dynamic/lan.peterson.com.ar.zone and bump SOA serial (2026041104 → 2026041901), then run bind9 playbook with force_dynamic_zone_update=true
4. Run playbook — ansible-playbook playbooks/corosync_qnetd/setup.yaml -i inventories/qnetd.yaml
5. Configure qdevice on NAS nodes — Install corosync-qdevice on nas-01/nas-02, run pcs qdevice setup model net --qnetd-hostname qnetd-01 and pcs quorum device add model net host=qnetd-01 algorithm=ffsplit
6. Switch quorum policy — pcs property set no-quorum-policy=stop

Context

Addresses the quorum gap identified after the STONITH incident (#656) where a switch auto-update caused corosync quorum loss. With qnetd providing a third vote, single-node failures result in proper quorum behavior instead of relying on the unsafe no-quorum-policy=ignore setting.