Proxmox: migrate host integration from root SSH (pct/conf parsing) to the Proxmox REST API

## Summary

The Proxmox provider reaches the node entirely over **root SSH**, shelling out to
`pct`/`pvesm` and parsing `/etc/pve/lxc/*.conf`. Move this integration to the
**Proxmox REST API** (token-authenticated) so remo no longer requires root SSH to
the node and works against structured data instead of CLI/conf text.

## Current state (SSH-based)

All node interaction goes through `_ssh_run` / `_run_on_node` → `ssh @ …`
in `src/remo_cli/providers/proxmox.py`:

- **sync** — `pct list` for inventory, then a bulk read of `/etc/pve/lxc/*.conf`
for tags (`_read_tags_by_vmid`).
- **create/destroy/update** — Ansible over SSH (`pct create`, `pvesm`,
`grep /etc/pve/lxc/*.conf`), not the `community.general.proxmox` API module.
- **snapshots / info / resize** — `pct config`, `pct status`, `pct snapshot`,
`pct rollback`, `pvesm status`, reading `/etc/pve/lxc/.conf`.

The SSH user defaults to `root` (`user or "root"`), and `/etc/pve` (pmxcfs) is
root/www-data only — so the current model effectively requires **root on the node**.

There is already a vestigial `_parse_pct_json` helper documented as "kept around …
may be useful for a future `--output-format json` flag" — i.e. an API/JSON path
was contemplated but never wired in.

## Motivation

- **No root SSH.** A scoped API token (created in the Proxmox UI/`pveum`) with
least-privilege roles replaces full root shell access to the node.
- **Structured data, not text scraping.** `GET /nodes/{node}/lxc` returns each
container with a `tags` field directly, eliminating the `pct list` +
conf-file parsing entirely — including the snapshot-section tag-shadowing class
of bug (a conf `grep '^tags:'` also matches snapshot sections; see the fix in
feature 013 `_read_tags_by_vmid`). The API's `tags` is the *current* config,
full stop.
- **Robustness.** No dependency on shell quoting, glob expansion, `pct` output
column layout, or pmxcfs file paths.
- **Parity.** Aligns Proxmox with the other API-based cloud provider (Hetzner uses
`HETZNER_API_TOKEN`), giving a consistent "provider needs a token" mental model.

## Proposed scope

Phase this; sync is the natural first slice.

1. **Auth/config** — read a Proxmox API token (e.g. `PROXMOX_API_TOKEN` +
host/port/node), with the existing SSH path kept as a fallback during
migration.
2. **sync** — replace `pct list` + `_read_tags_by_vmid` with
`GET /nodes/{node}/lxc` (name, vmid, `tags`), preserving the 013 marker
filtering (`remo` tag) and `--all` behavior unchanged.
3. **Marker apply** — replace `pct set --tags` with the config API
(`PUT /nodes/{node}/lxc/{vmid}/config`, tag-set union preserved).
4. **Follow-ups** — migrate create/destroy/update/snapshots/info/resize, or
decide which stay on Ansible/SSH.

## Notes / open questions

- Verify against remo's minimum supported Proxmox VE version(s).
- Decide token scope/roles to document (least privilege for list + config edit +
lifecycle).
- Keep this decoupled from feature 014 (register-ssh-host), which is about
registering an already-SSH-reachable *container*, not node access.
- TLS: Proxmox API is https on :8006 with a self-signed cert by default — decide
cert-verification/pinning strategy.

## Not doing now

Feature 013 (managed-instance tagging) stays on the current SSH model; only the
snapshot-tag correctness fix landed there. This issue tracks the larger,
separate migration.

Start in src/remo_cli/providers/proxmox.py, tracing sync through _ssh_run/_run_on_node and _read_tags_by_vmid, then inspect the existing _parse_pct_json helper. The first slice should authenticate with a Proxmox API token, list /nodes/{node}/lxc, preserve remo filtering and --all behavior, and apply marker tags through the config API; TLS, roles, version support, and later lifecycle operations remain open decisions.

Written by the indexing model from the issue text.