k8s-edge: pin to neptune + declare USB passthrough mappings (cutover prep)

target_node flips from the `saturn` placeholder to `neptune`: VM 103
(legacy HAOS) currently holds the ZWA-2 + stromzaehler USBs on neptune,
so co-locating k8s-edge VM 153 on the same host means at cutover the
USBs rebind from VM 103 → VM 153 in-place with no physical move.

USB block declared on VM 153 ahead of the cutover apply. Until VM 103
is destroyed, the USB devices are still claimed there; this declaration
is therefore not safe to apply in isolation — it lands at the final-
migration `tofu apply` after VM 103 destroy releases the devices.

k8s-edge also stays a Proxmox VM (no bare-metal pivot) — decision
recorded inline + in wiki note k8s-edge-target-node-neptune-decision.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

opentofu/vm_153_k8s_edge.tf

@@ -10,14 +10,16 @@
 #   - Tainted `workload-class=pinned:NoSchedule`; only pods that tolerate
 #     that taint land here (see patches/k8s-edge.yaml)
 #
-# `target_node` is a placeholder — update it once the Proxmox host that
-# carries the USB dongles is chosen. The module ignores node_name changes
-# so later edits here won't force replacement.
+# Pinned to neptune: VM 103 (legacy HAOS) currently holds the ZWA-2 +
+# stromzaehler USB mappings on neptune; at HA cutover the USBs rebind
+# from VM 103 to this VM in-place on the same host (no physical move).
+# k8s-edge stays a Proxmox VM (decision 2026-05-05) — bare-metal N100
+# trajectory is shelved.
 module "k8s_edge" {
   source = "./modules/proxmox_vm"
 
   name        = "k8s-edge.srv.renner.uno"
-  target_node = "saturn"
+  target_node = "neptune"
   vmid        = 153
   memory      = 6144
   cores       = 2
@@ -57,6 +59,26 @@ module "k8s_edge" {
     }
   ]
 
+  # USB passthrough mappings — currently held by VM 103 (legacy HAOS) on
+  # this same neptune host. Declared here ahead of the cutover apply: at
+  # the final-migration `tofu apply` VM 103 is destroyed first (releasing
+  # the device claim) and this VM picks them up on the same physical host
+  # with no cabling change. Until that cutover apply runs, do NOT apply
+  # this block in isolation — Proxmox would refuse the attach because VM
+  # 103 still holds the devices.
+  usb = [
+    {
+      mapping_id = "stromzaehler"
+      usb3       = false
+      id         = "0"
+    },
+    {
+      mapping_id = "ZWA-2"
+      usb3       = false
+      id         = "1"
+    }
+  ]
+
   tags            = "kubernetes;talos;worker;edge"
   ssh_public_keys = local.common_ssh_keys