Add bootstrap scripts and restructure runbook

- scripts/run-bootstrap.sh: copies and runs the deploy user bootstrap on a
  fresh server, verifies SSH login, checks vault as a preflight step
- scripts/bootstrap-deploy-user.sh: runs on the server as root, accepts the
  SSH public key as an argument (read from keys/ by run-bootstrap.sh)
- scripts/check-vault.sh: decrypts vault.yml and verifies all 11 required
  secrets are present and non-empty
- docs/runbook.md: restructured into correct order (collections → DNS → vault
  → bootstrap → playbook), added scripts reference table, moved first-run
  notes for Gitea/Keycloak/registry into their own section
- README.md: added scripts/ to repo layout

README.md

@@ -66,6 +66,10 @@ Repo layout:
 			k8s/             # k3s Kubernetes node
 	docs/
 		runbook.md           # step-by-step reinstall instructions
+	scripts/
+		run-bootstrap.sh     # bootstrap deploy user on a fresh server
+		bootstrap-deploy-user.sh  # runs on server as root — creates deploy user
+		check-vault.sh       # verify vault.yml has all required secrets
 	keys/
 		*.pub                # public SSH keys (private keys are gitignored)