Make the k3s API firewall allowlist declarative

The live host restricted 6443/tcp to specific operator addresses, added by hand,
while this role still declared the port open to Anywhere with no source
restriction. The declared config was weaker than reality: running the base role
would have REMOVED the restriction and exposed the Kubernetes API to the
internet. Security was tightened on the host and never fed back into the source
of truth.

Found 2026-08-11 while diagnosing lost cluster access, which turned out to be an
ISP lease rotation (89.244.90.246 -> .236) against a hand-maintained allowlist.

Changes:
- defaults: k3s_api_allowed_sources (empty = 6443 closed to all external
  sources, the safe failure; SSH unaffected so the host stays recoverable) and
  k3s_api_revoked_sources, so rotated addresses are pruned rather than left as
  standing grants to whoever the ISP reassigns them to
- tasks: grant approved sources, then remove any blanket rule, then revoke
  retired ones. Order matters - grants are added before the blanket rule is
  deleted so convergence never opens a window with no API access
- group_vars/all.yaml: the current operator address, plus the two stale grants
  (.246 rotated, 85.132.220.102 historic) marked for revocation
- docs/verification.md: state that 6443 is source-restricted rather than
  listing it as a plainly allowed port

Not yet converged against the live host - the role change is committed but
running it is a production action needing operator approval.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/verification.md

@@ -10,7 +10,11 @@ a reproducible, CI-friendly pass/fail verdict.
 of every managed node. It covers:
 
 - **Firewall** — UFW active, default deny inbound, required ports allowed
-  (SSH 22/tcp, k3s API 6443/tcp, Flannel VXLAN 8472/udp)
+  (SSH 22/tcp, Flannel VXLAN 8472/udp). The k3s API (6443/tcp) is
+  **source-restricted**, not world-open: only addresses in
+  `k3s_api_allowed_sources` may reach it, and `k3s_api_revoked_sources` is
+  pruned on convergence. A host with an empty allowlist has 6443 closed to all
+  external sources — the safe failure, recoverable over SSH.
 - **SSH daemon** — root login disabled, password auth disabled, pubkey auth enabled
 - **Services** — ufw, fail2ban, ssh.socket enabled and running
 - **Packages** — ufw, fail2ban, git, curl, vim, htop (age and sops installed as binaries)