proxmox: deployment files, sample, user guide and doc rows

The optional proxmox-token Secret (token, ca.pem) mounted at
/etc/proxy-operator/proxmox, make proxmox-token-secret with content
checks that never print the token, a commented proxmox-home entry in
both providers configs, and config/samples/proxy_proxmox.yaml.
TestLoadConfig_proxmoxSampleEntry loads the commented entry from both
files, and a second test ties the sample Proxy's placement to it.

docs/proxmox-provider.md is the user guide: prerequisites and privileges,
cluster setup, config reference, placement, what lands on Proxmox,
logging, tracing, timeouts, health check, error classes, known gaps and
testing. providers-existing.md gains the proxmox column and section;
architecture.md, the README, providers.md and CLAUDE.md gain their rows.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

config/samples/proxy_proxmox.yaml

@@ -0,0 +1,46 @@
+# A Managed proxy backed by a Proxmox VE cluster through the proxmox
+# provider: the operator full-clones a prepared template on the named node,
+# attaches a NoCloud seed ISO carrying this cloud-init, and starts the VM on
+# the configured network (here VLAN 4 on vmbr0, IP from that network's
+# DHCP), where cloud-init installs Squid. Requires a providers-config entry
+# named "proxmox-home" (see providers-config.yaml) and the proxmox-token
+# Secret (docs/proxmox-provider.md).
+#
+# placement.zone is a node name from proxmox.nodes (optional when only one
+# node is configured); machineType and image are keys in the provider's
+# machineTypes and templates maps. The address comes from the guest agent,
+# which a vendor-data script installs at first boot, so the VM's network
+# needs a route to a package mirror.
+apiVersion: crawl.example.com/v1alpha1
+kind: Proxy
+metadata:
+  name: proxy-proxmox-sample
+spec:
+  mode: Managed
+  provider: proxmox-home
+  placement:
+    zone: pv1-1
+    machineType: small
+    image: debian-13
+  port: 3128
+  cloudInit:
+    inline: |
+      #cloud-config
+      packages:
+        - squid
+      write_files:
+        - path: /etc/squid/conf.d/proxy-operator.conf
+          content: |
+            http_port 3128
+            http_access allow all
+            via off
+            forwarded_for off
+      runcmd:
+        - systemctl restart squid
+      # Optional: log in with `ssh debian@<ip>` (the Debian image's default
+      # user) to look around; `qm terminal <vmid>` on the node works too.
+      # ssh_authorized_keys:
+      #   - ssh-ed25519 AAAA... you@laptop
+  attributes:
+    geo: home
+    purpose: crawl