Add dot1x and wpa_supplicant for 802.1X authentication

- Configure dot1x on access switch host-facing ports (Et3/Et4) with
  RADIUS dynamic VLAN assignment
- Switch host-facing port-channels to access mode (from trunk) to
  align with dot1x dynamic VLAN behavior
- Add wpa_supplicant configs and binds for all hosts
- Remove VLAN subinterfaces from hosts, assign IPs directly to bond0
  (untagged traffic for dot1x access ports)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hosts/freeradius/wpa_supplicant_host1.conf

@@ -0,0 +1,10 @@
+ctrl_interface=/var/run/wpa_supplicant
+eapol_version=2
+ap_scan=0
+
+network={
+    key_mgmt=IEEE8021X
+    eap=MD5
+    identity="host1_user"
+    password="host1pass"
+}