rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/PROJECT.md

@@ -0,0 +1,66 @@
+---
+id: PROJECT
+type: project
+status: active
+title: Project Overview
+created: '2026-09-09'
+updated: '2026-09-09'
+tags:
+- project
+- ansible
+- infrastructure
+related:
+- PRODUCT-BRIEF
+- CONSTRAINTS
+source_paths:
+- AGENTS.md
+- README.md
+confidence: confirmed
+---
+
+# Project Overview
+
+## Name
+
+`ansible-playbooks` - central Ansible collection for Debian host management.
+
+## Goal
+
+Provide a single, reusable Ansible repository to provision, harden, update,
+and monitor Debian hosts in a consistent, documented, and repeatable way.
+
+## Domain
+
+Infrastructure automation and IT operations:
+
+- Target hosts are Debian systems, partially running as LXC containers on
+  Proxmox.
+- Execution happens in a controlled Docker runtime environment
+  (`execute.sh`, `docker/`).
+- Secrets are managed via Ansible Vault (`vault.yml`, git-ignored `.vault_pass`).
+
+## Roles (building blocks)
+
+| Role               | Purpose                                                        |
+|--------------------|----------------------------------------------------------------|
+| `bootstrap`        | Initial setup: packages, admin user, SSH, MOTD, sysctl, Docker, monitoring |
+| `docker`           | Docker Engine installation from the official repository        |
+| `hawser`           | Update of the Hawser Docker Compose stack                      |
+| `healthcheck`      | Quality gate: verify running containers after updates          |
+| `manage-ssh-keys`  | SSH key management (hardening)                                 |
+| `monitoring`       | Zabbix Agent 2: installation, TLS-PSK, Docker plugin, API registration |
+| `os-updates`       | Debian package updates with mirror switch, reboot, and logging |
+
+## Constraints
+
+See [Constraints](./requirements/constraints.md). Key points: Debian-only
+playbooks, LXC-aware skips for `sysctl`/`reboot`, mandatory documentation of
+every change, FQCN module usage, secrets never committed in plain text.
+
+## Stakeholders
+
+Not explicitly documented yet. See [STATUS.md](./STATUS.md) open questions.
+
+## Success Criteria
+
+Not explicitly documented yet. See [STATUS.md](./STATUS.md) open questions.