feat(bcn01-lab): onboard BCN01-LAB site and extend module with WAN2 support

- Add sites/BCN01-LAB with full Meraki configuration: VLANs, SSIDs,
  switch ports, 802.1X policy, firewall rules, WAN uplinks and warm spare
- Extend modules/meraki-site to support wan2_* fields in mx_wan_uplinks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sites/BCN01-LAB/variables.tf

@@ -0,0 +1,15 @@
+# Sensitive variables — injected via TF_VAR_* environment variables (GitHub Secrets).
+# Never put values for these in any .tf file.
+
+variable "radius_secret" {
+  type        = string
+  sensitive   = true
+  default     = ""
+  description = "RADIUS shared secret. Pass via TF_VAR_radius_secret (GitHub Secret: RADIUS_SECRET)."
+}
+
+variable "wifi_password_psk" {
+  type        = string
+  sensitive   = true
+  description = "PSK Wi-Fi password. Pass via TF_VAR_wifi_password_psk (GitHub Secret: WIFI_PASSWORD_PSK)."
+}