Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

tools/grimmory-mcp/README.md

@@ -0,0 +1,42 @@
+# Grimmory OpenCode MCP
+
+Read-only Grimmory `v3.2.4` API integration with manual synchronization to
+individual Obsidian book notes.
+
+## Security
+
+- Grimmory mutations are not implemented.
+- Authentication uses the current user's local login because annotations and
+  reading progress are user-scoped.
+- The password is read from a mode `0600` file and is never passed in argv.
+- Access and refresh tokens remain in process memory only.
+
+## Configure
+
+```bash
+cd tools/grimmory-mcp
+npm install
+npm run configure
+```
+
+The default password file is:
+
+```text
+~/.config/opencode/secrets/grimmory_password
+```
+
+## Obsidian behavior
+
+- Notes: `90 Library/Books/<title> — grimmory-<id>.md`
+- Covers: `99 System/Export/Grimmory/Covers/<id>.<ext>`
+- Existing notes are matched by `grimmory_id`, so title changes rename instead
+  of duplicate the note.
+- Text between `grimmory:user:start` and `grimmory:user:end` is preserved.
+- Generated metadata, progress, annotations and sessions are replaced from
+  Grimmory on every sync.
+- `99 System/INDEX.md` is rebuilt after a successful manual sync.
+
+## OpenCode
+
+Restart OpenCode after changing its MCP configuration. Run `/grimmory-sync` to
+synchronize the complete accessible library manually.