feat: accept proxmox API-token auth alongside password

roles/global_defaults/tasks/validation.yml

@@ -166,6 +166,21 @@
     label: "hypervisor.{{ item }}"
   no_log: true
 
+- name: Validate Proxmox authentication (password or API token)
+  when:
+    - system_cfg.type == "virtual"
+    - hypervisor_type == "proxmox"
+  ansible.builtin.assert:
+    that:
+      - >-
+        (hypervisor_cfg.password | default('') | string | length > 0)
+        or (hypervisor_cfg.token_id | default('') | string | length > 0
+            and hypervisor_cfg.token_secret | default('') | string | length > 0)
+    fail_msg: >-
+      Proxmox requires either hypervisor.password or
+      hypervisor.token_id + hypervisor.token_secret (API token).
+    quiet: true
+
 - name: Validate VMware placement (cluster or node required, mutually exclusive)
   when:
     - system_cfg.type == "virtual"