Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/roles/emergency_bot/tasks/bootstrap.yml

@@ -0,0 +1,48 @@
+---
+- name: Create emergency bot user
+  ansible.builtin.user:
+    name: "{{ emergency_bot_user }}"
+    system: true
+    shell: /usr/sbin/nologin
+    create_home: false
+
+- name: Create emergency bot state directory
+  ansible.builtin.file:
+    path: "{{ emergency_bot_state_dir }}"
+    state: directory
+    owner: "{{ emergency_bot_user }}"
+    group: "{{ emergency_bot_user }}"
+    mode: "0700"
+
+- name: Generate emergency bot control key
+  ansible.builtin.command:
+    cmd: "ssh-keygen -q -t ed25519 -N '' -f {{ emergency_bot_control_key_path }}"
+    creates: "{{ emergency_bot_control_key_path }}"
+  become: true
+  become_user: "{{ emergency_bot_user }}"
+  no_log: true
+
+- name: Set emergency bot control key ownership
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: file
+    owner: "{{ emergency_bot_user }}"
+    group: "{{ emergency_bot_user }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - path: "{{ emergency_bot_control_key_path }}"
+      mode: "0600"
+    - path: "{{ emergency_bot_control_key_path }}.pub"
+      mode: "0644"
+  no_log: true
+
+- name: Read emergency bot control public key
+  ansible.builtin.slurp:
+    src: "{{ emergency_bot_control_key_path }}.pub"
+  register: emergency_bot_control_key
+  no_log: true
+
+- name: Store emergency bot control public key for mini-pc configuration
+  ansible.builtin.set_fact:
+    emergency_bot_control_public_key: "{{ emergency_bot_control_key.content | b64decode | trim }}"
+  no_log: true