Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/playbooks/emergency-access.yml

@@ -0,0 +1,42 @@
+---
+- name: Bootstrap emergency-bot control identity
+  hosts: emergency-bot
+  gather_facts: false
+  tasks:
+    - name: Create emergency-bot control identity
+      ansible.builtin.include_role:
+        name: emergency_bot
+        tasks_from: bootstrap
+
+- name: Configure mini-pc reverse SSH client and restricted control path
+  hosts: mini-pc
+  gather_facts: false
+  vars:
+    emergency_vps_host_key: "{{ lookup('env', 'EMERGENCY_VPS_HOST_KEY') }}"
+    emergency_bot_control_public_key: "{{ hostvars['emergency-bot'].emergency_bot_control_public_key }}"
+  tasks:
+    - name: Configure mini-pc emergency access client
+      ansible.builtin.include_role:
+        name: emergency_access
+        tasks_from: client
+
+- name: Configure ru-vps reverse SSH endpoint
+  hosts: ru-vps
+  gather_facts: false
+  vars:
+    emergency_reverse_public_key: "{{ hostvars['mini-pc'].emergency_reverse_public_key }}"
+  tasks:
+    - name: Configure ru-vps emergency access endpoint
+      ansible.builtin.include_role:
+        name: emergency_access
+        tasks_from: endpoint
+
+- name: Configure and enable emergency Telegram bot
+  hosts: emergency-bot
+  gather_facts: false
+  vars:
+    emergency_bot_token: "{{ lookup('env', 'EMERGENCY_BOT_TOKEN') }}"
+    emergency_bot_allowed_user_ids: "{{ lookup('env', 'EMERGENCY_ALLOWED_USER_IDS') }}"
+    emergency_mini_pc_host_key: "{{ lookup('env', 'EMERGENCY_MINI_PC_HOST_KEY') }}"
+  roles:
+    - role: emergency_bot