feat(talos): bootstrap Kubernetes cluster funk (3 nodes, v1.33.1)

- Add talconfig.yaml with compute-01/02/03 (nvme0n1, Flannel CNI)
- Add SOPS/age encryption for talsecret.sops.yaml
- Add patches: NTP/DNS → storage-01, kubelet reserved for 8GB workers
- Fix nftables: open DHCP port 67 for cluster LAN
- Add dnsmasq DHCP with static leases for all 3 compute nodes
- Add admin/talos.md: full install procedure + admin commands
- Install kubectl + talosctl on storage-01

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/dnsmasq/defaults/main.yml

@@ -1,7 +1,22 @@
 ---
 dns_upstream:
-  - 8.8.8.8
-  - 8.8.4.4
+  - 1.1.1.1
+  - 9.9.9.9
+
+dhcp_range_start: 192.168.10.50
+dhcp_range_end: 192.168.10.99
+dhcp_lease_time: 12h
+
+dhcp_static_hosts:
+  - mac: "6c:4b:90:82:8e:47"
+    name: compute-01
+    ip: 192.168.10.11
+  - mac: "6c:4b:90:cf:7f:c5"
+    name: compute-02
+    ip: 192.168.10.12
+  - mac: "6c:4b:90:b6:49:20"
+    name: compute-03
+    ip: 192.168.10.13
 
 dns_cluster_hosts:
   - name: storage-01

ansible/roles/dnsmasq/templates/dnsmasq.conf.j2

@@ -23,6 +23,16 @@ address=/{{ host.name }}.{{ dns_domain }}/{{ host.ip }}
 address=/{{ host.name }}/{{ host.ip }}
 {% endfor %}
 
+# DHCP — plage dynamique pour le LAN cluster
+dhcp-range={{ dhcp_range_start }},{{ dhcp_range_end }},{{ dhcp_lease_time }}
+dhcp-option=option:dns-server,{{ lan_ip }}
+dhcp-option=option:router,{{ lan_ip }}
+
+# Baux statiques (MAC → IP fixe, ajoutés après récupération des MACs)
+{% for host in dhcp_static_hosts %}
+dhcp-host={{ host.mac }},{{ host.name }},{{ host.ip }}
+{% endfor %}
+
 # Cache
 cache-size=1000
 

ansible/roles/gateway/templates/nftables.conf.j2

@@ -20,9 +20,10 @@ table inet filter {
         # SSH depuis le LAN domestique et le LAN cluster
         tcp dport 22 ip saddr { 192.168.1.0/24, 192.168.10.0/24 } accept
 
-        # DNS (dnsmasq)
+        # DNS + DHCP (dnsmasq)
         udp dport 53 ip saddr 192.168.10.0/24 accept
         tcp dport 53 ip saddr 192.168.10.0/24 accept
+        udp dport 67 iif {{ lan_interface }} accept
 
         # NFS
         tcp dport { 111, 2049 } ip saddr 192.168.10.0/24 accept