feat: migrate all managed LXC provisioning to OpenTofu (blue-green)

Blue-green: a new container is created beside the old one, data is copied, the
IP is moved onto it, and the old container is kept stopped as rollback for at
least a week. Keeping the IP means only the VMID changes, and its consumers
(backup jobs, backup audit) already derive it from the registry.

Batch 1 (2026-09-02): emergency-bot 148->151, docker-test 145->152,
gitea 141->153, vaultwarden 140->154, monitoring 146->155, gyro 150->156,
grimmory 149->157.
Batch 2 (2026-09-03): adguard 144->158, mihomo 143->159, ovpn-mini 132->160.
All migratable LXC are now provisioner: tofu. hermes-ai (frozen) and pbs stay.

- tofu/services.tf + tofu/svc-*.tf: one resource per service, reproducing the
  pct-config etalon. /dev/fuse -> features.fuse; /dev/net/tun ->
  device_passthrough (first live use on mihomo and ovpn-mini); gitea bind mount
  -> datastore volume (data finally reaches PBS); console { type = "shell" }
  declared explicitly (provider tracks cmode there).
- services.yml: vmid + provisioner: tofu for every migrated service; features
  strings and device notes updated to the tofu representation; also drops the
  memoir-bot entry and adds homelab_reverse_proxy_image/_unit.
- pve-*.yml: configuration play target is `{{ pve_config_target | default(...) }}`
  so it can run against <name>-new on a temp address (a bare --limit zeroes the
  play instead of retargeting it). Container-creation plays are gated behind
  `provisioner != 'tofu'` / `pve_provisioning_enabled` (meta: end_play), so a
  stray run cannot pct start a stopped OLD VMID on a live IP. Override for
  intentional legacy rollback: -e pve_<svc>_legacy_provisioning_enabled=true.
- ssh_config: drop memoir-bot; ovpn-mini gets ProxyJump none (a jump via ru-vps
  would route through the very tunnel ovpn-mini terminates).
- gyro.yml / uptime-kuma.yml: same pve_config_target override.
- roles/uptime_kuma: only freeze homelab-monitoring when the unit actually
  exists (a fresh blue-green container never had it).
- offsite-restic-yadisk.yml: the gitea restic profile now runs inside the LXC
  (hosts: gitea), since the bind-mount host path is gone after the volume move;
  lost+found excluded (unreadable in an unprivileged LXC, restic exit 3).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/offsite-restic-yadisk.yml

@@ -1,23 +1,36 @@
+# Профиль выполняется ВНУТРИ контейнера gitea, а не на ноде cloud-pc.
+# До переезда на OpenTofu (2026-09-02) данные жили в bind mount каталога ноды
+# /opt/data/gitea, и профиль работал на самой ноде. После переезда данные —
+# это volume контейнера (mp0 на datastore), снаружи LXC такого пути больше нет,
+# поэтому профиль переехал внутрь по образцу vaultwarden. Репозиторий restic
+# тот же, цепочка снапшотов продолжается; изменились только пути внутри них.
 - name: Configure Gitea offsite backup to Yandex Disk
-  hosts: cloud-pc
+  hosts: gitea
   gather_facts: false
   vars:
+    ansible_become: false
     offsite_profile: gitea
     offsite_repository: rclone:yadisk:System/Backups/HomeLab/restic/gitea
-    offsite_source_path: /opt/data/gitea
-    offsite_sqlite_db: /opt/data/gitea/gitea/gitea.db
+    offsite_source_path: /opt/gitea/data
+    offsite_sqlite_db: /opt/gitea/data/gitea/gitea.db
     offsite_backup_tag: gitea,cloud-pc,yadisk
     offsite_timer_oncalendar: "*-*-* 04:15:00"
     offsite_rclone_config_local: ~/.config/rclone/rclone.conf
     offsite_restic_password_local: "{{ playbook_dir }}/../generated/restic-offsite-password"
     offsite_excludes:
-      - /opt/data/gitea/gitea/gitea.db
-      - /opt/data/gitea/gitea/gitea.db-shm
-      - /opt/data/gitea/gitea/gitea.db-wal
-      - /opt/data/gitea/gitea/log/**
-      - /opt/data/gitea/gitea/sessions/**
-      - /opt/data/gitea/gitea/queues/**
-      - /opt/data/gitea/gitea/tmp/**
+      - /opt/gitea/data/gitea/gitea.db
+      - /opt/gitea/data/gitea/gitea.db-shm
+      - /opt/gitea/data/gitea/gitea.db-wal
+      - /opt/gitea/data/gitea/log/**
+      - /opt/gitea/data/gitea/sessions/**
+      - /opt/gitea/data/gitea/queues/**
+      - /opt/gitea/data/gitea/tmp/**
+      # lost+found появился вместе с переходом на volume: это свежая ext4, и
+      # каталог принадлежит uid 0 хоста, что внутри unprivileged LXC видно как
+      # nobody:nogroup и нечитаемо. Без исключения restic отдаёт exit 3
+      # ("at least one source file could not be read") и юнит падает каждую
+      # ночь, хотя снапшот при этом сохраняется. Найдено 2026-09-02.
+      - /opt/gitea/data/lost+found/**
   tasks:
     - name: Configure restic offsite profile
       ansible.builtin.include_tasks: ../tasks/offsite-restic-profile.yml