docs(reference-ansible): add docs/ tree and document repo, playbooks, Makefile

Addresses the WKS PoC review (Notion 2026-05-26). All docs in English.
- README: purpose, docs table of contents, annotated repo tree
- docs/getting_started.md: prerequisites (WKS account, OIDC, SSH, VPN) + first deploy
- docs/ansible.md: playbook table, "Running Ansible", service parameters, cheatsheet
- docs/secrets.md: canonical Bao login (moved out of README) + demo defaults
- docs/operations.md: full Makefile reference
- docs/inventories.md: repo layout, topology, standard folder structure, walkthrough
- docs/testing.md: static checks, inventory resolution, smoke test / dry run
- remove ARCHITECTURE.md (architecture docs live externally)

Also includes the gymburgdorf inventory build-out (bookstack, homarr,
opnform, send) and scripts/bao-seed.sh. site.yml keeps a third traefik
play (traefik_servers minus the vagrant _dmz/_backend split) so the demo
inventories still configure their reverse proxy after the rebase onto main.

.claude/settings.json

@@ -1,9 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(rtk curl *)",
-      "Bash(python3 -c ' *)",
-      "Bash(ssh root@172.16.19.101 'docker exec nextcloud-nextcloud-1 php /var/www/html/occ config:app:get core \"appstoreFetcher-lastFailure\" 2>&1; echo ===; docker exec nextcloud-nextcloud-1 php /var/www/html/occ config:app:get core \"appstore-fetcher-lastFailure\" 2>&1; echo ===; docker exec nextcloud-nextcloud-1 php /var/www/html/occ config:app:get core \"AppFetcher-lastFailure\" 2>&1')"
-    ]
-  }
-}

.gitignore

@@ -14,6 +14,8 @@
 /.idea/
 # macOS
 .DS_Store
+# Claude Code local settings
+.claude/
 # Ansible
 /collections/ansible_collections/
 .vagrant/