Add Gitea Actions runner, ansible-lint CI, vault setup, and fix group_vars layout

- Move group_vars into inventory/ so playbooks can find them (was only
  visible to ad-hoc commands via CWD)
- Add Ansible Vault for sensitive variables (gitea/grafana passwords,
  tokens, db credentials) with vault_password_file outside the repo
- Enable Gitea Actions and deploy act_runner with Docker backend on
  the gitea VM
- Add .gitea/workflows/lint.yml to run ansible-lint on every push
- Set up Gitea → GitHub push mirror (sync_on_commit)
- Fix ansible.cfg stdout_callback for ansible-core 2.20 compatibility
- Add python-psycopg2 to gitea role (required for postgresql modules)
- Add docker to gitea_runner role (required by act_runner at startup)
- Exclude password hashes and VM images from git

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/physical-install.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Run this inside the Arch live environment on physical hardware.
+# Fetches the config generator from the host HTTP server, generates the config
+# for the correct SSD device, then starts archinstall.
+#
+# Usage:
+#   curl http://<host-ip>:8080/scripts/physical-install.sh | bash
+#   or with device override:
+#   curl http://<host-ip>:8080/scripts/physical-install.sh -o /tmp/install.sh
+#   bash /tmp/install.sh /dev/sda
+set -euo pipefail
+
+HOST="${HOST:-http://192.168.1.1:8080}"   # update to your host's LAN IP
+DEVICE="${1:-}"
+
+echo "==> Available disks:"
+lsblk -d -o NAME,SIZE,MODEL
+echo
+
+if [[ -z "$DEVICE" ]]; then
+    read -rp "Enter SSD device for OS install (e.g. /dev/sda): " DEVICE
+fi
+
+echo "==> Fetching config generator..."
+curl -fsSL "$HOST/scripts/generate-physical-config.sh" -o /tmp/generate-config.sh
+chmod +x /tmp/generate-config.sh
+
+echo "==> Generating config for $DEVICE..."
+/tmp/generate-config.sh "$DEVICE"
+
+echo "==> Starting archinstall..."
+archinstall --config /tmp/config.json