Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

tools/grimmory-mcp/src/configure.js

@@ -0,0 +1,42 @@
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+
+const destination =
+  process.env.GRIMMORY_PASSWORD_FILE ||
+  path.join(os.homedir(), ".config/opencode/secrets/grimmory_password");
+
+if (!process.stdin.isTTY) {
+  console.error("Run this command in an interactive terminal.");
+  process.exit(1);
+}
+
+process.stdout.write("Grimmory password: ");
+process.stdin.setRawMode(true);
+process.stdin.resume();
+process.stdin.setEncoding("utf8");
+
+let password = "";
+process.stdin.on("data", async (character) => {
+  if (character === "\u0003") process.exit(130);
+  if (character === "\r" || character === "\n") {
+    process.stdin.setRawMode(false);
+    process.stdin.pause();
+    process.stdout.write("\n");
+    if (!password) {
+      console.error("Password cannot be empty.");
+      process.exit(1);
+    }
+    await mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
+    await writeFile(destination, password, { mode: 0o600 });
+    await chmod(destination, 0o600);
+    console.log(`Password saved to ${destination}`);
+    return;
+  }
+  if (character === "\u007f") {
+    password = password.slice(0, -1);
+    return;
+  }
+  password += character;
+});