fix: load static token id and validate token secret

- Store non-sensitive Proxmox token id in terraform.tfvars
- Inject only token secret via workflow-generated secrets.auto.tfvars
- Add variable validations for token id format and non-empty token secret
- Add workflow debug output for token secret length and selected token id

.gitea/workflows/terraform-apply.yml

@@ -18,7 +18,6 @@ jobs:
         working-directory: terraform
         run: |
           cat > secrets.auto.tfvars << EOF
-          pm_api_token_id     = "${{ secrets.PM_API_TOKEN_ID }}"
           pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}"
           SSH_KEY_PUBLIC      = "${{ secrets.SSH_KEY_PUBLIC }}"
           TS_AUTHKEY          = "${{ secrets.TS_AUTHKEY }}"