Author Talos machineconfigs with scale-out day-one settings

Part of #241. **Ready now** — the machineconfig targets a cluster
rather than a chassis, so it doesn't wait on hardware.

## Summary

Author the Talos machineconfig for node 1 in this repo, baking in the
day-one settings that avoid rework when the cluster scales out.

## Scope

- Generate the factory image reference with the **i915 extension** for
QuickSync.
- Reserve a LAN IP for the L2 VIP and set it as the cluster endpoint;
document the bootstrap ordering (bootstrap against node 1's **real
IP** — the VIP activates only post-bootstrap).
- Set `cluster.allowSchedulingOnControlPlanes: true` (with a note to
revert once workers exist).
- Record **pod and service CIDRs explicitly** in the machineconfig.
- Label node 1 for **GPU affinity** (Plex) from the start.
- Keep machineconfigs (and secrets handling) in the repo per the Talos
API-only model.

## Acceptance criteria

- [ ] Node-1 machineconfig committed, referencing the i915 factory image
- [ ] VIP LAN IP reserved; endpoint = VIP; bootstrap-against-real-IP
ordering documented
- [ ] `allowSchedulingOnControlPlanes: true` set (revert-when-workers
note present)
- [ ] Pod/service CIDRs recorded explicitly
- [ ] Node 1 carries the GPU-affinity label
- [ ] New files carry SPDX headers; pre-commit passes

Refs: https://docs.siderolabs.com/talos/v1.13/deploy-and-manage-workloads/workloads-on-controlplane
· https://joshrnoll.com/creating-a-kubernetes-cluster-with-talos-linux-on-tailscale/