docs(reference-ansible): add docs/ tree and document repo, playbooks, Makefile

Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.

inventories/demo-gymburgdorf/host_vars/application/homarr.yml

@@ -0,0 +1,71 @@
+---
+# Bao secret <mount>/data/homarr expected to contain:
+#   secret_encryption_key (64 hex chars), admin_password, oidc_client_secret
+_homarr: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/homarr', url=vault_addr) }}"
+
+homarr_domain: "home.gymb.souveredu.ch"
+homarr_extra_domains:
+  - "home.int.gymb.souveredu.ch"
+homarr_base_url: "https://home.gymb.souveredu.ch"
+
+homarr_secret_encryption_key: "{{ _homarr.secret_encryption_key }}"
+homarr_admin_username: "admin"
+homarr_admin_email: "admin@gymb.souveredu.ch"
+homarr_admin_password: "{{ _homarr.admin_password }}"
+
+# OIDC against Authentik. credentials provider stays enabled as a
+# break-glass account.
+homarr_auth_providers: "credentials,oidc"
+homarr_oidc_issuer: "https://auth.int.gymb.souveredu.ch/application/o/homarr/"
+homarr_oidc_client_id: "homarr"
+homarr_oidc_client_secret: "{{ _homarr.oidc_client_secret }}"
+homarr_oidc_client_name: "Authentik"
+homarr_oidc_scopes: "openid profile email groups"
+homarr_oidc_groups_attribute: "groups"
+homarr_oidc_admin_group: "homarr-admins"
+homarr_oidc_auto_login: "false"
+
+# Default board with shortcuts to the other gymburgdorf services. Width
+# values describe horizontal grid cells (1-10 desktop / 6 tablet / 2
+# mobile, packed left-to-right).
+homarr_apps:
+  - id: nextcloud
+    name: Nextcloud
+    description: "Cloud Storage & Collaboration"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/nextcloud.png
+    href: https://cloud.gymb.souveredu.ch
+    width: 2
+  - id: collabora
+    name: Collabora Office
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/collaboraonline.png
+    href: https://office.gymb.souveredu.ch
+    width: 2
+  - id: drawio
+    name: Draw.io
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/drawio.png
+    href: https://draw.gymb.souveredu.ch
+    width: 2
+  - id: send
+    name: Send
+    description: "Encrypted file-share"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/firefox-send.png
+    href: https://send.gymb.souveredu.ch
+    width: 2
+  - id: opnform
+    name: OpnForm
+    description: "Self-hosted forms"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/opnform.png
+    href: https://forms.gymb.souveredu.ch
+    width: 2
+  - id: bookstack
+    name: BookStack
+    description: "Wiki & documentation"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/bookstack.png
+    href: https://wiki.gymb.souveredu.ch
+    width: 2
+  - id: authentik
+    name: Authentik
+    description: "Identity provider"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/authentik.png
+    href: https://auth.gymb.souveredu.ch
+    width: 2