feat(ansible): idempotent role-based host config for both production VMs

common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles,
orchestrated by site.yml with the ordering that matters (firewall/TLS land
before the services that depend on them). Ansible Vault for secrets, no new
tool introduced for this project's modest secret surface. Explicit
dev/staging/production environment separation, no secrets committed
(.gitignore covers vault plaintext, TLS keys, Terraform state, *.env).

Validated: ansible-playbook --syntax-check clean.

infra/.gitignore

@@ -0,0 +1,29 @@
+# Never commit filled secrets — only *.env.template files are tracked.
+*.env
+!*.env.template
+
+# Docker TLS material — CA/server/client certs and keys, generated by
+# infra/scripts/docker-tls/generate-ca.sh and friends. Templates/READMEs stay tracked.
+infra/docker/tls/*.pem
+infra/docker/tls/*.key
+infra/docker/tls/*.crt
+infra/docker/tls/*.srl
+!infra/docker/tls/**/README.md
+
+# Ansible Vault password files and any decrypted vars
+infra/ansible/.vault_pass
+infra/ansible/**/vault_plain.yml
+
+# Terraform/OpenTofu state and generated vars (may contain resource IDs/IPs)
+infra/terraform/**/*.tfstate
+infra/terraform/**/*.tfstate.*
+infra/terraform/**/.terraform/
+infra/terraform/**/terraform.tfvars
+!infra/terraform/**/terraform.tfvars.example
+
+# Backup output and restore scratch space
+infra/backup/output/
+infra/backup/restore-test/
+
+# Load test results (local artifacts, not source)
+infra/scripts/loadtest/results/