feat(BCN01-LAB): puerto AP trunk y VLAN 111 WAN sin L3

- Puerto 3 eqt-lab-st01-sw01: trunk, native 108 (APs), tagged 100+101
- VLAN 111 WAN sin subnet ni appliance_ip (switching puro)
- subnet/appliance_ip pasan a ser opcionales en el módulo

modules/meraki-site/variables.tf

@@ -30,11 +30,12 @@ variable "firewall_rules" {
 # SSIDs wireless
 variable "wireless_ssids" {
   type = list(object({
-    number           = number
-    name             = string
-    enabled          = optional(bool, true)
-    auth_mode        = string
-    splash_page      = optional(string, "None")
+    number              = number
+    name                = string
+    enabled             = optional(bool, true)
+    auth_mode           = string
+    psk                 = optional(string, null)  # Contraseña WPA2/WPA3-PSK (sensible, usar TF_VAR o secret)
+    splash_page         = optional(string, "None")
     wpa_encryption_mode = optional(string, "WPA3 only")
     ip_assignment_mode  = optional(string, "Bridge mode")
     use_vlan_tagging    = optional(bool, false)
@@ -61,8 +62,8 @@ variable "radius_secret" {
 variable "switch_vlans" {
   type = map(object({
     name          = string
-    subnet        = string
-    appliance_ip  = string
+    subnet        = optional(string, null)  # null para VLANs sin L3 (p.ej. WAN puro switching)
+    appliance_ip  = optional(string, null)
     dhcp_handling = optional(string, "Run a DHCP server")
     reserved_ip_ranges = optional(list(object({
       comment = string