chore: relocate .env to the repository root and refresh Make targets

.env is now consumed by both Ansible and OpenTofu, so keep a single copy at
the repo root instead of ansible/.env:

- rename ansible/.env.example -> .env.example.
- Makefile: ENV_FILE ?= $(REPO_ROOT)/.env (absolute, works from any cwd);
  REQUIRE_ENV/LOAD_ENV updated; help text.
- bootstrap-pve-api-token.yml / bootstrap-monitoring-pve-token.yml write and
  read ../../.env; bootstrap now keeps backup: true (it rewrites the whole
  file, clobbering MONITORING_*/EMERGENCY_*/PROXMOX_ROOT_PASSWORD).
- roles/pve_lxc, roles/monitoring_server: fail_msg points at the repo-root .env.

The Makefile also picks up the new targets added by later commits
(tofu-*, validate, pbs-storage, ru-vps-base, zerotier-decommission); they are
grouped here so all recipes land together.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/bootstrap-pve-api-token.yml

@@ -37,10 +37,17 @@
         pve_token_data: "{{ pve_token_add.stdout | from_json }}"
       no_log: true
 
-    - name: Write local ansible/.env
+    # ВНИМАНИЕ: задача переписывает файл ЦЕЛИКОМ, а не правит отдельные строки.
+    # Всё, что добавлено вручную или другими целями — MONITORING_*, EMERGENCY_*,
+    # PROXMOX_ROOT_PASSWORD — будет потеряно. Поэтому backup: true.
+    # Строки пишутся с префиксом `export`: по нему bootstrap-monitoring-pve-token.yml
+    # находит их своим lineinfile (regexp: "^export NAME="), и он же позволяет
+    # просто сделать `source .env` в обычном шелле.
+    - name: Write the local .env in the repository root
       ansible.builtin.copy:
-        dest: "{{ playbook_dir }}/../.env"
+        dest: "{{ playbook_dir }}/../../.env"
         mode: "0600"
+        backup: true
         content: |
           export PROXMOX_HOST={{ ansible_host }}
           export PROXMOX_USER='{{ pve_api_user }}'