docs(reference-ansible): add docs/ tree and document repo, playbooks, Makefile

Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.

Makefile

@@ -10,6 +10,18 @@ bao:
 	bao login -method=oidc -path=Digitalboard role=default
 	$(eval export VAULT_TOKEN=$(shell bao print token))
 
+# Seed/merge OpenBao secrets for a demo inventory. Idempotent: existing
+# keys are kept; only missing keys are generated. Pass DRY_RUN=1 to
+# preview without writing.
+seed_bao_gymburgdorf:
+	scripts/bao-seed.sh demo-gymburgdorf
+
+seed_bao_mbazürich:
+	scripts/bao-seed.sh demo-mbazürich
+
+seed_bao_phbern:
+	scripts/bao-seed.sh demo-phbern
+
 ping_demo:
 	echo "# pinging demo-gymburgdorf"
 	ansible all -i inventories/demo-gymburgdorf/hosts.yml -m ping || true