Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/playbooks/pve-monitoring.yml

@@ -0,0 +1,42 @@
+---
+- name: Create monitoring LXC on cloud-pc
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: false
+  vars:
+    ansible_become: false
+    ansible_python_interpreter: "{{ ansible_playbook_python }}"
+    pve_lxc_vmid: 146
+    pve_lxc_node: cloud-pc
+    pve_lxc_hostname: monitoring
+    pve_lxc_ip: 192.168.1.30/24
+    pve_lxc_gateway: 192.168.1.1
+    pve_lxc_disk: data:24
+    pve_lxc_cores: 2
+    pve_lxc_memory: 4096
+    pve_lxc_swap: 512
+    pve_lxc_startup: order=80
+    pve_lxc_features:
+      - nesting=1
+    pve_lxc_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
+  roles:
+    - role: pve_lxc
+
+- name: Enable Docker keyctl feature for monitoring LXC
+  hosts: cloud-pc
+  gather_facts: false
+  tasks:
+    - name: Read monitoring LXC configuration
+      ansible.builtin.command: pct config 146
+      register: monitoring_lxc_config
+      changed_when: false
+
+    - name: Enable keyctl for Docker in monitoring LXC
+      ansible.builtin.command: pct set 146 --features nesting=1,keyctl=1
+      when: "'keyctl=1' not in monitoring_lxc_config.stdout"
+      register: monitoring_lxc_keyctl
+
+    - name: Restart monitoring LXC after feature change
+      ansible.builtin.command: pct reboot 146
+      when: monitoring_lxc_keyctl.changed