sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/dns_resolver/handlers/main.yml

@@ -1,3 +1,5 @@
 ---
-- name: update resolvconf
-  command: resolvconf -u
+- name: restart dnscrypt-proxy
+  systemd:
+    name: dnscrypt-proxy
+    state: restarted

roles/dns_resolver/tasks/main.yml

@@ -1,24 +1,16 @@
 ---
-- name: Set DNS resolver (resolvconf)
+- name: DNS resolver auf DoH setzen (via automation1)
   copy:
     content: |
       nameserver 10.5.85.5
-      nameserver 1.1.1.1
-    dest: /etc/resolvconf/resolv.conf.d/head
-    mode: '0644'
-  when: ansible_facts.packages is defined and 'resolvconf' in ansible_facts.packages
-  notify: update resolvconf
-
-- name: Set DNS resolver (direct)
-  copy:
-    content: |
-      nameserver 10.5.85.5
-      nameserver 1.1.1.1
     dest: /etc/resolv.conf
     mode: '0644'
-  when: ansible_facts.packages is not defined or 'resolvconf' not in ansible_facts.packages
+  when: inventory_hostname != 'automation1'
 
-- name: Gather package facts
-  package_facts:
-    manager: auto
-  when: ansible_facts.packages is not defined
+- name: dnscrypt-proxy stoppen auf VMs (nicht noetig)
+  systemd:
+    name: dnscrypt-proxy
+    state: stopped
+    enabled: false
+  when: inventory_hostname != 'automation1'
+  ignore_errors: true