rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/requirements/constraints.md

@@ -0,0 +1,47 @@
+---
+id: CONSTRAINTS
+type: note
+status: active
+title: Constraints
+created: '2026-09-09'
+updated: '2026-09-09'
+tags:
+- requirements
+- constraints
+related:
+- PROJECT
+source_paths:
+- AGENTS.md
+confidence: confirmed
+---
+
+# Constraints
+
+Explicitly documented constraints for this repository (source: `AGENTS.md`).
+
+## Technical Constraints
+
+- **Debian-only**: every playbook must check
+  `ansible_facts['os_family'] == "Debian"` and abort on non-Debian hosts.
+- **LXC containers**: tasks affecting `sysctl` or `reboot` must check
+  `virtualization_type != "lxc"` and be skipped there.
+- **Ansible style**: modules use FQCN (`ansible.builtin.apt`, ...);
+  variable defaults live in `roles/<name>/defaults/main.yml`, never hardcoded
+  in tasks; role logic is split into `tasks/<name>.yml` subtask files with
+  `tasks/main.yml` containing only imports.
+- **Templates** use `# {{ ansible_managed }}` as header.
+- **Execution environment**: changes to collections require updating
+  `docker/requirements.yml` and rebuilding the Docker image.
+
+## Process Constraints
+
+- **Documentation duty**: every new feature, parameter, or variable must be
+  documented in the corresponding README before commit (see `AGENTS.md`
+  mapping table).
+- **Code language**: documentation in German, code (variable names, task
+  names) in English.
+- **Secrets**: sensitive values belong in encrypted `vault.yml`; `.vault_pass`,
+  `setenv.sh`, `logs/`, and `.zabbix-psk/` are git-ignored and must never be
+  committed. No plaintext secrets in `defaults/` or `group_vars/`.
+- **Testing**: changes are tested in the Docker container (`./execute.sh`),
+  with `ansible-lint` and `--check` dry runs where sensible.