feat(containers): mount shared read-only volume into created containers

[runleveldev]

Summary

Adds an mp0 mount point to every created container: /mnt/pve/<templateStorage>/volumes/quick_and_dirty is bind-mounted read-only at /mnt/quick_and_dirty.

The host path is derived from the node's resolved template storage, assuming the storage is mounted at /mnt/pve/<storage> (i.e. container templates are downloaded to /mnt/pve/<storage>/template/cache), so shared volumes live at /mnt/pve/<storage>/volumes/<name>.

This is an intentional stopgap: the volume name is hardcoded to quick_and_dirty. #421 tracks turning this into a proper feature where users can define their own volumes with per-volume permissions; a TODO(#421) is left on the new buildSharedVolumeMp0() helper.

Changes

• New buildSharedVolumeMp0(templateStorage) helper in create-a-container/bin/create-container.js building the mp0 value (/mnt/pve/<storage>/volumes/quick_and_dirty,mp=/mnt/quick_and_dirty,ro=1)
• OCI image path: mp0 added to the createLxc options, reusing the already-resolved template storage
• Template clone path: template storage is now resolved in this branch too (non-fatal — if no vztmpl-capable storage exists, the mount is skipped with a warning instead of failing creation, since cloning doesn't otherwise need one) and mp0 is applied via the post-clone updateLxcConfig call

Notes

• Proxmox restricts raw bind mounts (mp0 with a host path) to root@pam, so the manager's API credentials must allow this
• Docker nodes silently ignore the option (the Docker backend's createLxc only maps known fields), so Docker containers won't get the mount — noted in Support user-defined shared volumes for containers (replace hardcoded quick_and_dirty mp0) #421

Testing

• node --check create-a-container/bin/create-container.js passes (no backend test suite exists for these job scripts)

Refs #421

[Copilot]

Copilot wasn't able to review any files in this pull request.

[cmyers-mieweb]

Approved, we will need to loop back on this in the future and make an issue to make it an optional feature if the hardware is not under a ceph infrastructure.