fix(ci): correct nested PVE node name and mask secrets in logs

- Change FQDN from pve-test.local to pve.test.local so the PVE node
  name is "pve" (matching what tests expect)
- Mask the dynamically created API token and VM IP with ::add-mask::
  before they appear in workflow logs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/infrastructure/answer.toml.tftpl

@@ -1,7 +1,7 @@
 [global]
 keyboard = "en-us"
 country = "us"
-fqdn = "pve-test.local"
+fqdn = "pve.test.local"
 mailto = "test@test.local"
 timezone = "UTC"
 root_password = "${root_password}"