Add bootstrap scripts and restructure runbook

- scripts/run-bootstrap.sh: copies and runs the deploy user bootstrap on a
  fresh server, verifies SSH login, checks vault as a preflight step
- scripts/bootstrap-deploy-user.sh: runs on the server as root, accepts the
  SSH public key as an argument (read from keys/ by run-bootstrap.sh)
- scripts/check-vault.sh: decrypts vault.yml and verifies all 11 required
  secrets are present and non-empty
- docs/runbook.md: restructured into correct order (collections → DNS → vault
  → bootstrap → playbook), added scripts reference table, moved first-run
  notes for Gitea/Keycloak/registry into their own section
- README.md: added scripts/ to repo layout

scripts/bootstrap-deploy-user.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Run once as root on a fresh server to create the deploy user Ansible connects as.
+# Usage: bash bootstrap-deploy-user.sh <ssh-public-key>
+
+set -euo pipefail
+
+SSH_PUBKEY="${1:?Usage: bootstrap-deploy-user.sh <ssh-public-key>}"
+DEPLOY_USER="deploy"
+
+if [ "$(id -u)" -ne 0 ]; then
+  echo "ERROR: must be run as root" >&2
+  exit 1
+fi
+
+echo "==> Creating user '${DEPLOY_USER}'"
+if id "${DEPLOY_USER}" &>/dev/null; then
+  echo "    user already exists, skipping"
+else
+  adduser --disabled-password --gecos "" "${DEPLOY_USER}"
+fi
+
+echo "==> Adding '${DEPLOY_USER}' to sudo group"
+usermod -aG sudo "${DEPLOY_USER}"
+
+echo "==> Installing SSH authorized key"
+SSH_DIR="/home/${DEPLOY_USER}/.ssh"
+AUTH_KEYS="${SSH_DIR}/authorized_keys"
+mkdir -p "${SSH_DIR}"
+if grep -qF "${SSH_PUBKEY}" "${AUTH_KEYS}" 2>/dev/null; then
+  echo "    key already present, skipping"
+else
+  echo "${SSH_PUBKEY}" >> "${AUTH_KEYS}"
+fi
+chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "${SSH_DIR}"
+chmod 700 "${SSH_DIR}"
+chmod 600 "${AUTH_KEYS}"
+
+echo ""
+echo "Done."