Set up repo structure and implement base role

- Document architecture decisions in README (Ansible + Docker Compose + Traefik)
- Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles
- Implement base role: package install, deploy user, SSH hardening,
  UFW firewall (22/80/443), fail2ban, unattended-upgrades
- Add reinstall runbook in docs/runbook.md
- Add ansible/requirements.yml for community.general and ansible.posix

ansible/roles/base/templates/sshd_config.j2

@@ -0,0 +1,23 @@
+# Managed by Ansible — do not edit manually
+Port 22
+Protocol 2
+
+# Authentication
+PermitRootLogin no
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+PubkeyAuthentication yes
+AuthorizedKeysFile .ssh/authorized_keys
+
+# Only allow the deploy user over SSH
+AllowUsers {{ deploy_user }}
+
+# Misc hardening
+X11Forwarding no
+PrintMotd no
+MaxAuthTries 3
+LoginGraceTime 30
+
+UsePAM yes
+AcceptEnv LANG LC_*
+Subsystem sftp /usr/lib/openssh/sftp-server