Fix LXC password reset (501 on nonexistent lxc/exec endpoint)

[greenlogles]

Summary

Fixes a 501 Not Implemented when resetting an LXC container's root password.

The handler called POST /nodes/{node}/lxc/{vmid}/exec, which Proxmox does not implement — LXC has no REST exec endpoint (unlike QEMU's guest-agent agent/exec); pct exec is CLI-only.

501 Not Implemented: Method 'POST /nodes/node3/lxc/210/exec' not implemented

Fix

Run pct exec <vmid> -- chpasswd on the node over the same channels ProxUI already uses for snippet writes, feeding root:<password> on stdin so the secret never appears in the process list or shell history:

1. SSH as root — ProxUI's key installed and port 22 open (password on the stdin pipe).
2. node Shell — root@pam console, via a short-lived temp file that's removed after.

_ssh_run_root gained an optional stdin_data; a new _reset_lxc_root_password helper does the tiering; the route returns a clear, actionable error if no channel is usable.

Requirements / behavior

• Needs ProxUI SSH access set up to the node (Cloud-Init → Custom Snippet → Set up access) or a root@pam connection — there is no API path for LXC exec.
• The container must be running (already enforced).
• QEMU password reset (guest agent + cipassword fallback) is unchanged.

Testing

• 167 unit tests pass; black clean. Live pct exec path should be exercised against a running container on deploy.