feat: road-warrior OpenVPN profile for the phone (Android, static key)

playbooks/openvpn-phone.yml (make openvpn-phone) stands up a separate
point-to-point static-key instance on ru-vps: tcp/9444, tun2, 10.80.0.0/30,
homelab-openvpn-phone unit, NAT 10.80.0.0/30 -> LAN via tun0. The client
profile (with the secret) lands in ansible/generated/ada-phone.ovpn
(gitignored). Android client: "OpenVPN for Android" (Arne Schwabe) — the
official OpenVPN Connect does not support static-key configs.

- homelab_vpn_client_routes in group_vars/all/main.yml: shared surgical
  route list for both road-warrior profiles; not the whole /24, since the
  phone's home network is almost certainly 192.168.1.0/24 too
- openvpn-laptop.yml reuses that list instead of its own literal copy
- both playbooks: local profile write moved from `become: false` to
  `vars: {ansible_connection: local, ansible_become: false}` — the keyword
  did not suppress the inherited ansible_become on delegate_to: localhost

Deployed and verified on ru-vps 2026-09-03: service active, tun2 up, ufw
9444/tcp, NAT rule present, make openvpn-phone idempotent (changed=0 on
rerun), 192.168.1.30:8082 reachable from ru-vps. openvpn-laptop.yml is
still not applied on the live host.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG

ansible/inventory/group_vars/all/main.yml

@@ -23,6 +23,19 @@ homelab_service_range: 192.168.1.5-192.168.1.40
 # Total votes меньше Expected votes и флаг NV у узлов.
 homelab_pve_egress_ip: 85.143.112.108
 
+# Маршруты, которые road-warrior профили (openvpn-laptop.yml, openvpn-phone.yml)
+# добавляют клиенту. НЕ весь homelab_lan_cidr: домашняя сеть клиента почти
+# наверняка тоже 192.168.1.0/24, полный /24 перебил бы её. Диапазон покрывает
+# 192.168.1.5-.7, .8-.15, .16-.31, .32-.39, .40 — все managed-хосты и дашборд
+# (192.168.1.30), но не роутер (.1) и не игровой сервер (.100).
+homelab_vpn_client_routes:
+  - {network: 192.168.1.5, netmask: 255.255.255.255}
+  - {network: 192.168.1.6, netmask: 255.255.255.254}
+  - {network: 192.168.1.8, netmask: 255.255.255.248}
+  - {network: 192.168.1.16, netmask: 255.255.255.240}
+  - {network: 192.168.1.32, netmask: 255.255.255.248}
+  - {network: 192.168.1.40, netmask: 255.255.255.255}
+
 openvpn_network_cidr: 10.78.0.0/30
 openvpn_listen_port: 8443
 openvpn_forwarded_services: