chore: relocate .env to the repository root and refresh Make targets

.env is now consumed by both Ansible and OpenTofu, so keep a single copy at
the repo root instead of ansible/.env:

- rename ansible/.env.example -> .env.example.
- Makefile: ENV_FILE ?= $(REPO_ROOT)/.env (absolute, works from any cwd);
  REQUIRE_ENV/LOAD_ENV updated; help text.
- bootstrap-pve-api-token.yml / bootstrap-monitoring-pve-token.yml write and
  read ../../.env; bootstrap now keeps backup: true (it rewrites the whole
  file, clobbering MONITORING_*/EMERGENCY_*/PROXMOX_ROOT_PASSWORD).
- roles/pve_lxc, roles/monitoring_server: fail_msg points at the repo-root .env.

The Makefile also picks up the new targets added by later commits
(tofu-*, validate, pbs-storage, ru-vps-base, zerotier-decommission); they are
grouped here so all recipes land together.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

.env.example

@@ -0,0 +1,25 @@
+export PROXMOX_HOST=192.168.1.10
+export PROXMOX_USER='ansible@pve'
+export PROXMOX_TOKEN_ID='homelab'
+export PROXMOX_TOKEN_SECRET='replace-me'
+export PROXMOX_VALIDATE_CERTS=false
+# Optional local SSH-forward port when the control node reaches PVE through ru-vps.
+# export PROXMOX_PORT=18006
+
+# Override if the downloaded template name differs.
+export PVE_LXC_OSTEMPLATE='local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst'
+
+# Monitoring secrets. Keep actual values in ignored ansible/.env or Ansible Vault.
+export MONITORING_TELEGRAM_BOT_TOKEN='replace-me'
+export MONITORING_TELEGRAM_CHAT_ID='replace-me'
+export MONITORING_GRAFANA_ADMIN_PASSWORD='replace-me'
+export MONITORING_PVE_API_USER='monitoring@pve'
+export MONITORING_PVE_API_TOKEN_ID='prometheus'
+export MONITORING_PVE_API_TOKEN_SECRET='replace-me'
+
+# Emergency reverse SSH Telegram bot. Keep actual values in ignored ansible/.env
+# or Ansible Vault. Host keys are pinned public keys in the form "ssh-ed25519 AAAA...".
+export EMERGENCY_BOT_TOKEN='replace-me'
+export EMERGENCY_ALLOWED_USER_IDS='replace-me'
+export EMERGENCY_VPS_HOST_KEY='ssh-ed25519 replace-me'
+export EMERGENCY_MINI_PC_HOST_KEY='ssh-ed25519 replace-me'