Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/roles/monitoring_server/templates/alertmanager.yml.j2

@@ -0,0 +1,40 @@
+global:
+  resolve_timeout: 5m
+
+route:
+  receiver: telegram-warning
+  group_by: [alertname, instance]
+  group_wait: 30s
+  group_interval: 10m
+  repeat_interval: 6h
+  routes:
+    - matchers:
+        - severity="critical"
+      receiver: telegram-critical
+      repeat_interval: 2h
+
+inhibit_rules:
+  - source_matchers:
+      - alertname="ExporterDown"
+    target_matchers:
+      - alertname="LanServiceUnavailable"
+    equal: [instance]
+
+receivers:
+  - name: telegram-warning
+    telegram_configs:
+      - bot_token: "{{ monitoring_telegram_bot_token }}"
+        chat_id: {{ monitoring_telegram_chat_id }}
+        send_resolved: true
+        message: |-
+          [{{ "{{" }} .Status | toUpper {{ "}}" }}] {{ "{{" }} .CommonLabels.alertname {{ "}}" }}
+          {{ "{{" }} .CommonAnnotations.summary {{ "}}" }}
+
+  - name: telegram-critical
+    telegram_configs:
+      - bot_token: "{{ monitoring_telegram_bot_token }}"
+        chat_id: {{ monitoring_telegram_chat_id }}
+        send_resolved: true
+        message: |-
+          [{{ "{{" }} .Status | toUpper {{ "}}" }}] CRITICAL: {{ "{{" }} .CommonLabels.alertname {{ "}}" }}
+          {{ "{{" }} .CommonAnnotations.summary {{ "}}" }}