fix(security): move hardcoded test password to GitHub Actions secret

- CI workflow: PVE_PASSWORD now reads from secrets.PVE_TEST_PASSWORD
- variables.tf: removed default password, requires TF_VAR env var
- Integration README: examples use <your-test-password> placeholder
- create-api-token.sh: example IP changed to pve.example.com
- .gitignore: added .env/.env.* exclusion

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/infrastructure/variables.tf

@@ -66,8 +66,7 @@ variable "network_bridge" {
 }
 
 variable "test_vm_password" {
-  description = "Root password for the nested PVE instances"
+  description = "Root password for the nested PVE instances. Set via TF_VAR_test_vm_password env var."
   type        = string
   sensitive   = true
-  default     = "Testpass123!"
 }