refactor(provider): switch auth from password to API token

Prefer API token over username/password — scoped to least-privilege
TerraformRole, reduces blast radius if credentials leak.

terraform.tfvars.example

@@ -2,6 +2,5 @@
 # terraform.tfvars is gitignored to keep secrets out of version control.
 
 proxmox_endpoint = "https://192.168.1.10:8006/"
-proxmox_username = "terraform@pve"
-proxmox_password = "changeme"
-proxmox_insecure = true
+proxmox_api_token = "terraform@pve!terraform-nonprod=<secret>"
+proxmox_insecure = true