sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/hawser/tasks/main.yml

@@ -1,14 +1,44 @@
 ---
-- name: Hawser installieren (offizielles Install-Script)
+- name: Hawser installieren
   ansible.builtin.shell:
-    cmd: curl -fsSL https://raw.githubusercontent.com/Finsys/hawser/main/scripts/install.sh | bash
+    cmd: |
+      ARCH=$(dpkg --print-architecture)
+      VERSION=0.2.39
+      curl -fsSL "https://github.com/Finsys/hawser/releases/download/v${VERSION}/hawser_${VERSION}_linux_${ARCH}.tar.gz" | tar xz -C /usr/local/bin hawser
+      chmod +x /usr/local/bin/hawser
     creates: /usr/local/bin/hawser
 
+- name: Hawser config Verzeichnis
+  ansible.builtin.file:
+    path: /etc/hawser
+    state: directory
+
 - name: Hawser Token in Config setzen
   ansible.builtin.lineinfile:
     path: /etc/hawser/config
     regexp: '^TOKEN='
     line: "TOKEN={{ vault_hawser_token }}"
+    create: yes
+  notify: restart hawser
+
+- name: Hawser systemd Service
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/hawser.service
+    content: |
+      [Unit]
+      Description=Hawser Agent
+      After=docker.service
+      Requires=docker.service
+
+      [Service]
+      Type=simple
+      EnvironmentFile=/etc/hawser/config
+      ExecStart=/usr/local/bin/hawser
+      Restart=always
+      RestartSec=10
+
+      [Install]
+      WantedBy=multi-user.target
   notify: restart hawser
 
 - name: Hawser aktivieren und starten