sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

rotate-ssh-key.yml

@@ -0,0 +1,17 @@
+---
+# Phase 1: Add new key alongside old keys
+- name: Add new SSH key to all hosts
+  hosts: all
+  become: true
+  vars:
+    new_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026"
+  tasks:
+    - name: Set target user
+      set_fact:
+        target_user: "{{ base_user | default(ansible_user | default('sascha')) }}"
+
+    - name: Add new key (keep old keys)
+      ansible.posix.authorized_key:
+        user: "{{ target_user }}"
+        key: "{{ new_key }}"
+        state: present