feat: move proxmox discovery/import/sync into a first-party plugin

plugins/proxmox/backend/proxmox-import-auth.ts

@@ -0,0 +1,44 @@
+// Pure decision: which auth settings an imported Proxmox guest inherits.
+//
+// The frontend carries a parallel copy in
+// plugins/proxmox/frontend/proxmox-import-auth.ts. The two drifting apart is
+// what produced the reported import bug, so both are kept behaviourally
+// identical and each is unit-tested against the same matrix.
+export function resolveProxmoxImportAuth(
+  defaultAuthType: string | undefined,
+  credentialId: number | null | undefined,
+): {
+  authType: string;
+  credentialId: number | null;
+  overrideCredentialUsername: number;
+} {
+  // An explicit special auth type (none/opkssh/tailscale/vault/…) wins.
+  if (
+    defaultAuthType &&
+    defaultAuthType !== "credential" &&
+    !["password", "key"].includes(defaultAuthType)
+  ) {
+    return {
+      authType: defaultAuthType,
+      credentialId: null,
+      overrideCredentialUsername: 0,
+    };
+  }
+
+  // A credential (configured default OR inherited from the source host) is a
+  // concrete auth source -> use it, even when defaultAuthType is the
+  // "password"/"key" default.
+  if (credentialId) {
+    return {
+      authType: "credential",
+      credentialId,
+      overrideCredentialUsername: 0,
+    };
+  }
+
+  return {
+    authType: "none",
+    credentialId: null,
+    overrideCredentialUsername: 0,
+  };
+}