feat: move proxmox discovery/import/sync into a first-party plugin

plugins/proxmox/frontend/proxmox-import-auth.ts

@@ -0,0 +1,48 @@
+const SECRET_BACKED_AUTH_TYPES = new Set(["password", "key"]);
+const SECRETLESS_AUTH_TYPES = new Set([
+  "none",
+  "agent",
+  "opkssh",
+  "stepca",
+  "tailscale",
+  "vault",
+]);
+
+export type ProxmoxImportAuth = {
+  authType: string;
+  credentialId?: number;
+  overrideCredentialUsername?: boolean;
+};
+
+export function resolveProxmoxImportAuth(
+  defaultAuthType: string | undefined,
+  credentialId: number | null | undefined,
+): ProxmoxImportAuth {
+  // An explicit secretless auth choice (none/opkssh/tailscale/vault) wins.
+  if (defaultAuthType && SECRETLESS_AUTH_TYPES.has(defaultAuthType)) {
+    return { authType: defaultAuthType };
+  }
+
+  // A credential (configured default OR inherited from the source Proxmox host)
+  // is a concrete auth source -> use it, even when defaultAuthType is the
+  // "password"/"key" default. Otherwise imported guests end up as authType
+  // "none" although the host authenticates via a credential.
+  if (credentialId) {
+    return {
+      authType: "credential",
+      credentialId,
+      overrideCredentialUsername: false,
+    };
+  }
+
+  // Explicit non secret-backed special type without a credential.
+  if (
+    defaultAuthType &&
+    defaultAuthType !== "credential" &&
+    !SECRET_BACKED_AUTH_TYPES.has(defaultAuthType)
+  ) {
+    return { authType: defaultAuthType };
+  }
+
+  return { authType: "none" };
+}