Set up repo structure and implement base role

- Document architecture decisions in README (Ansible + Docker Compose + Traefik)
- Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles
- Implement base role: package install, deploy user, SSH hardening,
  UFW firewall (22/80/443), fail2ban, unattended-upgrades
- Add reinstall runbook in docs/runbook.md
- Add ansible/requirements.yml for community.general and ansible.posix

ansible/site.yml

@@ -0,0 +1,14 @@
+---
+- name: Full server provisioning
+  hosts: cloud
+  become: true
+  roles:
+    - base
+    - docker
+    - traefik
+    - gitea
+    - nextcloud
+    - sso
+    - mail
+    - registry
+    - k8s