docs(reference-ansible): add docs/ tree and document repo, playbooks, Makefile

Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

inventories/demo-gymburgdorf/host_vars/storage/garage.yml

@@ -12,8 +12,18 @@ garage_s3_domains:
 garage_webui_domain: "console.s3.gymb.souveredu.ch"
 garage_use_ssl: true
 garage_webui_enabled: true
+# Gate the WebUI behind authentik (admins-only, via policy-binding on the
+# authentik proxy app). Replaces the htpasswd Basic-Auth — AUTH_USER_PASS
+# is dropped from the compose env when this is true. The forwardauth URL
+# resolves to the application-host traefik (network alias
+# `auth.gymb.souveredu.ch` -> authentik-server-1 in the proxy network on
+# the application host), but THIS host (storage) is in a different LAN,
+# so traefik here reaches it via the public name through the DMZ proxy.
+garage_webui_authentik_forward_auth: true
+garage_webui_authentik_forward_auth_url: "https://auth.gymb.souveredu.ch/outpost.goauthentik.io/auth/traefik"
+# Kept for completeness — only used when authentik ForwardAuth is off.
 garage_webui_username: "admin"
-garage_webui_password: "{{ _garage.webui_password }}"
+garage_webui_password: "{{ _garage.webui_password | default('disabled') }}"
 
 garage_rpc_secret: "{{ _garage.rpc_secret }}"
 garage_admin_token: "{{ _garage.admin_token }}"