feat: road-warrior OpenVPN profile for the phone (Android, static key)

playbooks/openvpn-phone.yml (make openvpn-phone) stands up a separate
point-to-point static-key instance on ru-vps: tcp/9444, tun2, 10.80.0.0/30,
homelab-openvpn-phone unit, NAT 10.80.0.0/30 -> LAN via tun0. The client
profile (with the secret) lands in ansible/generated/ada-phone.ovpn
(gitignored). Android client: "OpenVPN for Android" (Arne Schwabe) — the
official OpenVPN Connect does not support static-key configs.

- homelab_vpn_client_routes in group_vars/all/main.yml: shared surgical
  route list for both road-warrior profiles; not the whole /24, since the
  phone's home network is almost certainly 192.168.1.0/24 too
- openvpn-laptop.yml reuses that list instead of its own literal copy
- both playbooks: local profile write moved from `become: false` to
  `vars: {ansible_connection: local, ansible_become: false}` — the keyword
  did not suppress the inherited ansible_become on delegate_to: localhost

Deployed and verified on ru-vps 2026-09-03: service active, tun2 up, ufw
9444/tcp, NAT rule present, make openvpn-phone idempotent (changed=0 on
rerun), 192.168.1.30:8082 reachable from ru-vps. openvpn-laptop.yml is
still not applied on the live host.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG

ansible/playbooks/openvpn-laptop.yml

@@ -16,19 +16,8 @@
     laptop_openvpn_client_ip: 10.79.0.2
     laptop_openvpn_remote: 157.22.231.198
     laptop_openvpn_client_config_local: "{{ playbook_dir }}/../generated/{{ laptop_profile_name }}.ovpn"
-    laptop_openvpn_home_routes:
-      - network: 192.168.1.5
-        netmask: 255.255.255.255
-      - network: 192.168.1.6
-        netmask: 255.255.255.254
-      - network: 192.168.1.8
-        netmask: 255.255.255.248
-      - network: 192.168.1.16
-        netmask: 255.255.255.240
-      - network: 192.168.1.32
-        netmask: 255.255.255.248
-      - network: 192.168.1.40
-        netmask: 255.255.255.255
+    # Общий список с openvpn-phone.yml — см. group_vars/all/main.yml.
+    laptop_openvpn_home_routes: "{{ homelab_vpn_client_routes }}"
 
   tasks:
     - name: Install OpenVPN packages
@@ -156,8 +145,10 @@
         path: "{{ playbook_dir }}/../generated"
         state: directory
         mode: "0700"
-      become: false
       delegate_to: localhost
+      vars:
+        ansible_connection: local
+        ansible_become: false
 
     - name: Write local laptop OpenVPN profile
       ansible.builtin.copy:
@@ -182,8 +173,10 @@
           <secret>
           {{ laptop_openvpn_static_key_raw.content | b64decode }}
           </secret>
-      become: false
       delegate_to: localhost
+      vars:
+        ansible_connection: local
+        ansible_become: false
       no_log: true
 
   handlers: