sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/patchmon-agent/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: Prüfen ob patchmon-agent bereits installiert ist
+  ansible.builtin.stat:
+    path: /usr/local/bin/patchmon-agent
+  register: patchmon_bin
+
+- name: Prüfen ob Agent bereits enrolled ist
+  ansible.builtin.command: /usr/local/bin/patchmon-agent ping
+  register: patchmon_ping
+  changed_when: false
+  failed_when: false
+  when: patchmon_bin.stat.exists
+
+- name: PatchMon Agent installieren (Auto-Enrollment)
+  ansible.builtin.shell: |
+    curl -sk "https://patchmon.sascha-lutz.de/api/v1/auto-enrollment/script?type=direct-host&token_key={{ vault_patchmon_token_key }}&token_secret={{ vault_patchmon_token_secret }}" | sh
+  args:
+    creates: /etc/patchmon/credentials.yml
+  when: not patchmon_bin.stat.exists or (patchmon_ping.rc is defined and patchmon_ping.rc != 0)
+
+- name: Server-URL sicherstellen
+  ansible.builtin.lineinfile:
+    path: /etc/patchmon/config.yml
+    regexp: '^patchmon_server:'
+    line: 'patchmon_server: "https://patchmon.sascha-lutz.de"'
+  notify: restart patchmon-agent
+
+- name: Docker-Integration aktivieren
+  ansible.builtin.lineinfile:
+    path: /etc/patchmon/config.yml
+    regexp: '^\s*docker:'
+    line: '    docker: true'
+  notify: restart patchmon-agent