Add Gitea Actions runner, ansible-lint CI, vault setup, and fix group_vars layout

- Move group_vars into inventory/ so playbooks can find them (was only
  visible to ad-hoc commands via CWD)
- Add Ansible Vault for sensitive variables (gitea/grafana passwords,
  tokens, db credentials) with vault_password_file outside the repo
- Enable Gitea Actions and deploy act_runner with Docker backend on
  the gitea VM
- Add .gitea/workflows/lint.yml to run ansible-lint on every push
- Set up Gitea → GitHub push mirror (sync_on_commit)
- Fix ansible.cfg stdout_callback for ansible-core 2.20 compatibility
- Add python-psycopg2 to gitea role (required for postgresql modules)
- Add docker to gitea_runner role (required by act_runner at startup)
- Exclude password hashes and VM images from git

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/vm-install.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Run this inside the Arch live environment to fetch the config and start archinstall.
+# Usage: curl http://192.168.122.1:8080/scripts/vm-install.sh | bash
+set -euo pipefail
+
+HOST="http://192.168.122.1:8080"
+
+echo "==> Fetching archinstall config..."
+curl -fsSL "$HOST/archinstall-config.json" -o /tmp/config.json
+
+echo "==> Starting archinstall..."
+archinstall --config /tmp/config.json