infra(net): repoint ansible inventory + Cilium VIPs to the Proxmox LAN

- ansible hosts.ini: node ansible_host -> 192.168.1.50/.51/.52, with a
  clear note that the PM may need to swap these for the pfSense
  NAT-forwarded address:port once that NAT rule exists (not guessed here).
  k3s_api_host derives from the inventory, so it follows automatically.
- Cilium CiliumLoadBalancerIPPool -> 192.168.1.53-.60 (matches the tofu
  cilium_l2_vip reservation on the new LAN).
- CiliumL2AnnouncementPolicy: broaden interface selector to ^e(n|th) so
  the Proxmox NIC name (ens18/eth0) need not be pinned; flagged
  verify-at-bringup.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/inventory/hosts.ini

@@ -1,16 +1,23 @@
-# Static inventory — ALIGNED with infra/tofu defaults (LOCKED PHASE1-SCOPE IPs).
+# Static inventory — ALIGNED with infra/tofu defaults (Proxmox migration IPs).
 # Regenerate from tofu when IPs/names are overridden:
 #   cd ../tofu && tofu output -raw ansible_inventory > ../ansible/inventory/hosts.ini
 #
 # k3s_primary = the --cluster-init server (embedded-etcd founder + Cilium k8sServiceHost).
 # k3s_secondary = the two servers that join it. All three are servers (HA embedded etcd).
+#
+# NAT HAND-OFF (PM to finalize): the nodes now live on the Proxmox LAN at
+# 192.168.1.50/.51/.52. The PM reaches them over a pfSense NAT that is NOT yet created.
+# Once the NAT/port-forward rule exists, the `ansible_host` (and possibly
+# `ansible_port`) below may need to be the NAT-forwarded address:port instead of the
+# raw node IP — do NOT guess it here. If the control node has direct LAN reachability
+# to 192.168.1.0/24, the raw IPs below are correct as-is.
 
 [k3s_primary]
-k3s-dev-1 ansible_host=10.73.0.11
+k3s-dev-1 ansible_host=192.168.1.50
 
 [k3s_secondary]
-k3s-dev-2 ansible_host=10.73.0.12
-k3s-dev-3 ansible_host=10.73.0.13
+k3s-dev-2 ansible_host=192.168.1.51
+k3s-dev-3 ansible_host=192.168.1.52
 
 [k3s_servers:children]
 k3s_primary