lldpd: run on physicals and expose neighbour topology as the lldp fact

LLDP is the only source of physical switch/port topology in the estate; NetBox
has no other way to learn which switch and port each machine is cabled to. Run
lldpd on physical hosts and surface its neighbour data so the terraform-infra
pdbmux backfill can populate NetBox interface connections.

- add profiles::lldpd installing the lldpd package and enabling+starting the
  service (it ships disabled), the service subscribing to the package
- assign it physicals-only via hiera_include in hieradata/virtual/physical.yaml
  (facts.virtual == 'physical'), merged unique with the common hiera_include; VMs
  never get it
- add the `lldp` custom fact (modules/libs/lib/facter/lldp.rb) parsing
  `lldpctl -f json0` into a per-interface map of neighbour chassis/port/vlan,
  skipping interfaces with no neighbour; confined to physical Linux hosts with
  lldpctl and a live lldpd socket, and never raising (empty hash on any error)

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

site/profiles/manifests/lldpd.pp

@@ -0,0 +1,33 @@
+# profiles::lldpd
+#
+# Runs lldpd on physical hosts so each machine learns its switch/port topology
+# via LLDP. The `lldp` fact exposes that neighbour data for NetBox. Assigned
+# via hiera_include from hieradata/virtual/physical.yaml (physicals only); the
+# lldpd.service ships disabled, so it is explicitly enabled and started here.
+class profiles::lldpd (
+  Boolean $enabled = true,
+  String  $package = 'lldpd',
+  String  $service = 'lldpd',
+){
+
+  if $enabled {
+    package { $package:
+      ensure => installed,
+    }
+
+    service { $service:
+      ensure    => running,
+      enable    => true,
+      subscribe => Package[$package],
+    }
+  } else {
+    service { $service:
+      ensure => stopped,
+      enable => false,
+    }
+
+    package { $package:
+      ensure => absent,
+    }
+  }
+}