feat(ansible): idempotent role-based host config for both production VMs

common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles,
orchestrated by site.yml with the ordering that matters (firewall/TLS land
before the services that depend on them). Ansible Vault for secrets, no new
tool introduced for this project's modest secret surface. Explicit
dev/staging/production environment separation, no secrets committed
(.gitignore covers vault plaintext, TLS keys, Terraform state, *.env).

Validated: ansible-playbook --syntax-check clean.

infra/environments/production/capacity.yml.example

@@ -0,0 +1,18 @@
+# Capacity planning inputs (Phase 4 §25). Copy to capacity.yml and fill in REAL measured values
+# once the actual Hetzner host and a real load test (infra/scripts/loadtest/) exist. The
+# numbers below are illustrative placeholders for a ~16c/32t/128GB host — do not treat them as
+# a real recommendation; run infra/scripts/capacity-model.js against real ones once measured.
+_placeholder: true
+
+host_cpu_cores: 32          # threads, if the host does hyperthreading — matches how Docker/cgroups count them
+host_mem_mb: 131072          # 128 GB
+
+platform_reserved_cpu_cores: 4    # rn-platform-01's VM allocation, reserved off the Lab Host's own pool
+platform_reserved_mem_mb: 16384
+
+proxmox_overhead_pct: 5      # hypervisor + host OS overhead — a conservative starting estimate
+
+measured_lab_cpu_cores: 2    # from infra/scripts/loadtest/sample-resources.sh peak CPU per Lab
+measured_lab_mem_mb: 2048    # from the same — peak memory per Lab
+
+safety_margin_pct: 20        # headroom kept unallocated even at the "recommended" threshold