Set up repo structure and implement base role

- Document architecture decisions in README (Ansible + Docker Compose + Traefik)
- Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles
- Implement base role: package install, deploy user, SSH hardening,
  UFW firewall (22/80/443), fail2ban, unattended-upgrades
- Add reinstall runbook in docs/runbook.md
- Add ansible/requirements.yml for community.general and ansible.posix

ansible/requirements.yml

@@ -0,0 +1,4 @@
+---
+collections:
+  - name: community.general   # ufw, timezone modules
+  - name: ansible.posix       # authorized_key module