feat(talos): bootstrap Kubernetes cluster funk (3 nodes, v1.33.1)

- Add talconfig.yaml with compute-01/02/03 (nvme0n1, Flannel CNI)
- Add SOPS/age encryption for talsecret.sops.yaml
- Add patches: NTP/DNS → storage-01, kubelet reserved for 8GB workers
- Fix nftables: open DHCP port 67 for cluster LAN
- Add dnsmasq DHCP with static leases for all 3 compute nodes
- Add admin/talos.md: full install procedure + admin commands
- Install kubectl + talosctl on storage-01

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/dnsmasq/defaults/main.yml

@@ -1,7 +1,22 @@
 ---
 dns_upstream:
-  - 8.8.8.8
-  - 8.8.4.4
+  - 1.1.1.1
+  - 9.9.9.9
+
+dhcp_range_start: 192.168.10.50
+dhcp_range_end: 192.168.10.99
+dhcp_lease_time: 12h
+
+dhcp_static_hosts:
+  - mac: "6c:4b:90:82:8e:47"
+    name: compute-01
+    ip: 192.168.10.11
+  - mac: "6c:4b:90:cf:7f:c5"
+    name: compute-02
+    ip: 192.168.10.12
+  - mac: "6c:4b:90:b6:49:20"
+    name: compute-03
+    ip: 192.168.10.13
 
 dns_cluster_hosts:
   - name: storage-01