docs(reference-ansible): add docs/ tree and document repo, playbooks, Makefile

Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.

inventories/demo-gymburgdorf/host_vars/application/traefik.yml

@@ -21,9 +21,26 @@ traefik_dmz_exposed_services:
     protocol: https
   - name: drawio
     domain: draw.gymb.souveredu.ch
-    # No internal FQDN/cert for drawio yet — proxy by IP. Combined
-    # with serversTransport `insecureSkipVerify` (handled by the
-    # selfsigned-mode branch in the template), or accept the route's
-    # 500 until the cert is wired up.
+    backend_host: draw.int.gymb.souveredu.ch
+    port: 443
+    protocol: https
+  - name: send
+    domain: send.gymb.souveredu.ch
+    backend_host: send.int.gymb.souveredu.ch
+    port: 443
+    protocol: https
+  - name: opnform
+    domain: forms.gymb.souveredu.ch
+    backend_host: forms.int.gymb.souveredu.ch
+    port: 443
+    protocol: https
+  - name: homarr
+    domain: home.gymb.souveredu.ch
+    backend_host: home.int.gymb.souveredu.ch
+    port: 443
+    protocol: https
+  - name: bookstack
+    domain: wiki.gymb.souveredu.ch
+    backend_host: wiki.int.gymb.souveredu.ch
     port: 443
     protocol: https