docs(reference-ansible): add docs/ tree and document repo, playbooks, Makefile

Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.

inventories/demo-gymburgdorf/host_vars/storage/traefik.yml

@@ -1,4 +1,12 @@
 ---
+# Local traefik needs to reach authentik for the ForwardAuth subrequest
+# the garage-webui router fires. The public IP is unreachable from this
+# subnet (no DMZ hairpin), so point auth.gymb.* directly at the
+# application host where authentik runs. Without this the forwardauth
+# middleware would time out and every garage-console request would 502.
+traefik_extra_hosts:
+  - "auth.gymb.souveredu.ch:172.16.19.101"
+
 # Services hosted on `storage` that the DMZ reverseproxy should forward
 # public traffic to. See application/traefik.yml for the mechanism.
 traefik_dmz_exposed_services: