Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/playbooks/pve-ovpn-mini.yml

@@ -0,0 +1,38 @@
+- name: Create ovpn-mini LXC on mini-pc
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  roles:
+    - role: pve_lxc
+      vars:
+        pve_lxc_vmid: 132
+        pve_lxc_node: mini-pc
+        pve_lxc_hostname: ovpn-mini
+        pve_lxc_ip: 192.168.1.23/24
+        pve_lxc_gateway: 192.168.1.1
+        pve_lxc_storage: local-lvm
+        pve_lxc_disk: local-lvm:8
+        pve_lxc_ostemplate: "{{ lookup('env', 'PVE_LXC_OSTEMPLATE') | default('local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst', true) }}"
+
+- name: Allow TUN device in ovpn-mini LXC config
+  hosts: mini-pc
+  gather_facts: false
+  become: true
+  handlers:
+    - name: restart ovpn-mini lxc
+      ansible.builtin.shell: pct stop 132 || true; pct start 132
+      changed_when: true
+  tasks:
+    - name: Allow /dev/net/tun device
+      ansible.builtin.lineinfile:
+        path: /etc/pve/lxc/132.conf
+        line: "lxc.cgroup2.devices.allow: c 10:200 rwm"
+        state: present
+      notify: restart ovpn-mini lxc
+
+    - name: Bind mount /dev/net/tun
+      ansible.builtin.lineinfile:
+        path: /etc/pve/lxc/132.conf
+        line: "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file"
+        state: present
+      notify: restart ovpn-mini lxc