refactor(provider): switch auth from password to API token

Prefer API token over username/password — scoped to least-privilege
TerraformRole, reduces blast radius if credentials leak.

main.tf

@@ -11,8 +11,7 @@ terraform {
 
 provider "proxmox" {
   endpoint = var.proxmox_endpoint
-  username = var.proxmox_username
-  password = var.proxmox_password
+  api_token = var.proxmox_api_token
 
   # Set to true if using a self-signed certificate (common on home labs)
   insecure = var.proxmox_insecure