Initial planning docs and hardening scripts for HA rebuild

Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path,
Ceph as the future HA storage upgrade, and baseline SSH/firewall
hardening.

scripts/switch-to-no-subscription-repo.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# Switch a fresh Proxmox VE install from the enterprise repo (which fails
+# on apt update without a paid subscription) to the no-subscription repo.
+# Idempotent - safe to re-run. Run as root on the PVE host.
+set -euo pipefail
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Must run as root." >&2
+    exit 1
+fi
+
+CODENAME="$(. /etc/os-release && echo "$VERSION_CODENAME")"
+
+ENTERPRISE_LIST="/etc/apt/sources.list.d/pve-enterprise.list"
+if [ -f "$ENTERPRISE_LIST" ]; then
+    sed -i 's/^deb/#deb/' "$ENTERPRISE_LIST"
+    echo "Disabled $ENTERPRISE_LIST"
+fi
+
+CEPH_ENTERPRISE_LIST="/etc/apt/sources.list.d/ceph.list"
+if [ -f "$CEPH_ENTERPRISE_LIST" ] && grep -q enterprise "$CEPH_ENTERPRISE_LIST" 2>/dev/null; then
+    sed -i 's/^deb/#deb/' "$CEPH_ENTERPRISE_LIST"
+    echo "Disabled $CEPH_ENTERPRISE_LIST"
+fi
+
+NOSUB_LIST="/etc/apt/sources.list.d/pve-no-subscription.list"
+cat > "$NOSUB_LIST" <<EOF
+deb http://download.proxmox.com/debian/pve ${CODENAME} pve-no-subscription
+EOF
+echo "Wrote $NOSUB_LIST for codename '${CODENAME}'."
+
+apt-get update
+echo "Repo switched. Review 'apt list --upgradable' before upgrading."