Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/roles/openvpn_gateway/templates/homelab.conf.j2

@@ -13,6 +13,14 @@ port {{ openvpn_listen_port }}
 {% for route in openvpn_home_routes %}
 route {{ route.network }} {{ route.netmask }}
 {% endfor %}
+{% for service in openvpn_forwarded_services %}
+route {{ service.target_host }} 255.255.255.255
+{% endfor %}
+{% if openvpn_forwarded_services | length > 0 %}
+script-security 2
+up /etc/openvpn/homelab/up.sh
+down /etc/openvpn/homelab/down.sh
+{% endif %}
 {% endif %}
 {% if openvpn_role == 'gateway' %}
 proto {{ openvpn_proto_client }}