sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sops-age.yml

@@ -0,0 +1,40 @@
+---
+- name: SOPS + Age Key Deployment
+  hosts: all
+  become: yes
+  tasks:
+    - name: sops installieren
+      ansible.builtin.shell: |
+        if ! command -v sops &>/dev/null; then
+          curl -sLo /usr/local/bin/sops https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.linux.amd64
+          chmod +x /usr/local/bin/sops
+        fi
+      args:
+        creates: /usr/local/bin/sops
+
+    - name: Age Key Verzeichnis erstellen
+      ansible.builtin.file:
+        path: /root/.config/sops/age
+        state: directory
+        mode: "0700"
+
+    - name: Age Key deployen
+      ansible.builtin.copy:
+        content: |
+          # created: 2026-04-04T09:42:26+02:00
+          # public key: age1z8gak2l4h0vpcnhtcdxmem2u9h2n54vuksk8ys82609qtzampuvqh50wdr
+          AGE-SECRET-KEY-19RPRZ89VNDR6KECR7ULA38P8KJ7FHMXJ9N07UUJHLGSVMUW69LHS89XDD2
+        dest: /root/.config/sops/age/keys.txt
+        mode: "0600"
+
+    - name: sops decrypt Hook fuer Git-Repos erstellen
+      ansible.builtin.copy:
+        content: |
+          #!/bin/bash
+          # Post-merge hook: decrypt .env.enc after git pull
+          if [ -f .env.enc ]; then
+            sops -d --input-type dotenv --output-type dotenv .env.enc > .env
+            echo "[sops] .env decrypted"
+          fi
+        dest: /usr/local/bin/sops-decrypt-env
+        mode: "0755"