fix: realm_type mapping, ha_groups crash on PVE 9.1, zero config values, token auth via $(...)

[lcaflc]

Four independent bug fixes, one commit each, each with a test that fails without the fix.

• fix(user): map the realm-type API key to realm_type. The API returns realm-type, the model read realm_type, so the column was always empty in user list and in the report. The report test now asserts the value, not just the key.
• fix(sanitycheck): skip non node-affinity HA rules in ha_groups. Since PVE 9.1, cluster/ha/rules also returns resource-affinity rules, which have no nodes key. The check raised KeyError: 'nodes' and aborted the whole sanitycheck. Adds a fake_ha_resource_affinity_rule fixture and tests for the check.
• fix(config): keep explicit zero values in per-cluster node and vm settings. The fallback to global settings tested truthiness, so a per-cluster memoryminimum: 0 (documented in the README) was replaced by the global value. Now only None / missing keys fall back.
• fix(auth): return command substitution output as text. $(command) returned bytes. proxmoxer 2.3.0 builds the token header with str.format, producing PVEAPIToken=b'root@pam'!b'ci'=b'abcd', so token auth with $(...) could not work. proxy_certificate JSON is now parsed from the str output. Adds tests for run_auth_commands.

Note: #83 also fixes the realm-type mapping as part of the dataclass refactor; the two will conflict on models/user.py, trivially.