feat(talos): bootstrap Kubernetes cluster funk (3 nodes, v1.33.1)

- Add talconfig.yaml with compute-01/02/03 (nvme0n1, Flannel CNI)
- Add SOPS/age encryption for talsecret.sops.yaml
- Add patches: NTP/DNS → storage-01, kubelet reserved for 8GB workers
- Fix nftables: open DHCP port 67 for cluster LAN
- Add dnsmasq DHCP with static leases for all 3 compute nodes
- Add admin/talos.md: full install procedure + admin commands
- Install kubectl + talosctl on storage-01

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

talos/patches/all.yaml

@@ -0,0 +1,8 @@
+machine:
+  time:
+    servers:
+      - 192.168.10.1
+      - time.cloudflare.com
+  network:
+    nameservers:
+      - 192.168.10.1

talos/patches/workers.yaml

@@ -0,0 +1,5 @@
+machine:
+  kubelet:
+    extraArgs:
+      system-reserved: cpu=500m,memory=1Gi
+      kube-reserved: cpu=500m,memory=1Gi

talos/talconfig.yaml

@@ -0,0 +1,64 @@
+clusterName: funk
+talosVersion: v1.13.0
+kubernetesVersion: v1.33.1
+endpoint: https://192.168.10.11:6443
+domain: cluster.local
+allowSchedulingOnControlPlanes: false
+
+clusterPodNets:
+  - 10.42.0.0/16
+clusterSvcNets:
+  - 10.43.0.0/16
+
+cniConfig:
+  name: flannel
+
+patches:
+  - "@./patches/all.yaml"
+
+nodes:
+  - hostname: compute-01
+    ipAddress: 192.168.10.11
+    installDisk: /dev/nvme0n1
+    controlPlane: true
+    networkInterfaces:
+      - deviceSelector:
+          driver: r8169
+        dhcp: false
+        addresses:
+          - 192.168.10.11/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 192.168.10.1
+
+  - hostname: compute-02
+    ipAddress: 192.168.10.12
+    installDisk: /dev/nvme0n1
+    controlPlane: false
+    patches:
+      - "@./patches/workers.yaml"
+    networkInterfaces:
+      - deviceSelector:
+          driver: r8169
+        dhcp: false
+        addresses:
+          - 192.168.10.12/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 192.168.10.1
+
+  - hostname: compute-03
+    ipAddress: 192.168.10.13
+    installDisk: /dev/nvme0n1
+    controlPlane: false
+    patches:
+      - "@./patches/workers.yaml"
+    networkInterfaces:
+      - deviceSelector:
+          driver: r8169
+        dhcp: false
+        addresses:
+          - 192.168.10.13/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 192.168.10.1