fix: use public ids in admin urls and fix oauth app table overflow

[jaspermayone]

Summary

This PR adds a hands-off install of spool, the Tier 0 jump host. Nothing runs against Proxmox until an operator applies with the new variable.

• spool/build-unattend.sh renders autounattend.xml and spool-setup.ps1 and writes a small ISO to spool/out/ (git-ignored).
• The answer file installs Windows Server 2025 Datacenter Evaluation (Desktop Experience) on the single SATA disk (UEFI/GPT) and skips OOBE.
• It sets SPOOL, "Eastern Standard Time" and 10.100.90.59/24. The gateway and DNS are script variables.
• It turns on RDP with NLA off. One firewall rule allows TCP 3389 only from 10.100.79.0/24.
• It disables the Print Spooler and installs RSAT-AD-Tools and GPMC.
• The script makes a random local Administrator password at each build. The password goes only into the ISO. LAPS takes over after the domain join.
• The answer file does not join the domain. The README gives the manual Add-Computer step.

Second CD-ROM

bpg/proxmox 0.116 allows only one cdrom block (issue bpg/terraform-provider-proxmox#718). A disk with file_id imports the ISO as a hard disk, and Windows Setup does not search hard disks for autounattend.xml. The experimental proxmox_vm resource has a cdrom map, but it has no EFI, TPM or disk support.

So terraform_data.spool_unattend_cdrom runs spool/attach-unattend.sh. The script uses the Proxmox API to set ide0 to the answer ISO, start the VM and press Enter at the "boot from CD" prompt. The token goes to curl on stdin. On destroy, the script removes ide0.

flowchart LR
  B["build-unattend.sh"] --> F["proxmox_virtual_environment_file.spool_unattend_iso"]
  F --> V["proxmox_virtual_environment_vm.spool (started = false)"]
  V --> T["terraform_data.spool_unattend_cdrom: ide0, start, Enter"]

Loading

Effect on other hosts

All new resources use count = create_spool && spool_unattend_iso_path != null. Both are off by default. The NixOS VMs (warp, skein, seam, hem) do not change. started = false on spool applies only at create, and started is in ignore_changes.

Checks

• tofu fmt -check, tofu init -backend=false, tofu validate: pass.
• xmllint --noout: the template and the rendered file are well-formed.
• shellcheck: pass for the three scripts.
• One test build made a 389 KB ISO with Joliet names. The password round trip worked. The output was then deleted.
• No plan or apply ran.

Open points

• Confirm the gateway from option 3 of the loom DHCP scope.
• sendkey needs VM.Console. Without it, press a key in the console at boot.
• ad/TIERING.md limits RDP to one VPN address. Set RDP_ALLOWED to a /32 to match.