feat(talos): bootstrap Kubernetes cluster funk (3 nodes, v1.33.1)

- Add talconfig.yaml with compute-01/02/03 (nvme0n1, Flannel CNI)
- Add SOPS/age encryption for talsecret.sops.yaml
- Add patches: NTP/DNS → storage-01, kubelet reserved for 8GB workers
- Fix nftables: open DHCP port 67 for cluster LAN
- Add dnsmasq DHCP with static leases for all 3 compute nodes
- Add admin/talos.md: full install procedure + admin commands
- Install kubectl + talosctl on storage-01

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.sops.yaml

@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: \.sops\.yaml$
+    age: age16rg9hnvnu89rll5schg8d2q5sccxlp7cxms9jmflguxapmtjp3lq0j4393