docs(reference-ansible): add docs/ tree and document repo, playbooks, Makefile

Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.

playbooks/site.yml

@@ -17,6 +17,17 @@
   roles:
     - digitalboard.core.traefik
 
+# Inventories without the _dmz/_backend split (e.g. demo-gymburgdorf,
+# where traefik_servers groups all_servers and dmz/backend is selected
+# per host via traefik_mode). The :!… intersection keeps this a no-op
+# for the vagrant topology, where every traefik_servers host is already
+# covered by the two plays above.
+- name: Configure reverse proxies
+  hosts: traefik_servers:!traefik_servers_dmz:!traefik_servers_backend
+  become: yes
+  roles:
+    - digitalboard.core.traefik
+
 - name: Deploy httpbin service
   hosts: httpbin_servers
   become: yes
@@ -71,23 +82,17 @@
   roles:
     - digitalboard.core.drawio
 
-# - name: Deploy send service
-#   hosts: send_servers
-#   become: yes
-#   roles:
-#     - digitalboard.core.send
-
-# - name: Deploy openforms service
-#   hosts: openforms_servers
-#   become: yes
-#   roles:
-#     - digitalboard.core.openforms
-
-- name: Deploy opencloud service
-  hosts: opencloud_servers
+- name: Deploy send service
+  hosts: send_servers
   become: yes
   roles:
-    - digitalboard.core.opencloud
+    - digitalboard.core.send
+
+- name: Deploy opnform service
+  hosts: opnform_servers
+  become: yes
+  roles:
+    - digitalboard.core.opnform
 
 - name: Deploy homarr service
   hosts: homarr_servers
@@ -95,8 +100,14 @@
   roles:
     - digitalboard.core.homarr
 
-- name: Deploy opnform service
-  hosts: opnform_servers
+- name: Deploy bookstack service
+  hosts: bookstack_servers
   become: yes
   roles:
-    - digitalboard.core.opnform
+    - digitalboard.core.bookstack
+
+- name: Deploy opencloud service
+  hosts: opencloud_servers
+  become: yes
+  roles:
+    - digitalboard.core.opencloud