rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/requirements/functional/INDEX.md

@@ -0,0 +1,15 @@
+# Functional Requirements
+
+This index routes to functional requirement topics; atomic REQ records live only in linked topic files.
+
+## When To Read
+
+- Work with product capabilities, workflows, integrations, or other functional behavior.
+
+## Key Files
+
+- [Host lifecycle operations](./host-lifecycle-operations.md) - REQ-001..REQ-006 (provisioning, docker, monitoring, updates, hawser, ssh keys)
+
+## Placeholders Or Stale Areas
+
+- None.

.project-wiki/requirements/functional/host-lifecycle-operations.md

@@ -0,0 +1,163 @@
+---
+id: REQ-FUNC-HOST-LIFECYCLE
+type: requirements
+status: active
+title: Host Lifecycle Operations
+created: '2026-09-09'
+updated: '2026-09-09'
+tags:
+- requirements
+- functional
+related:
+- PROJECT
+- PRODUCT-BRIEF
+source_paths:
+- README.md
+- AGENTS.md
+confidence: confirmed
+---
+
+# Host Lifecycle Operations
+
+Explicitly stated functional scope of the collection (source: root
+`README.md` purpose statement and playbook table; evidence linked in
+[requirement-evidence.yml](../../traceability/requirement-evidence.yml)).
+
+<a id="req-001"></a>
+
+## REQ-001 - Initial provisioning of Debian hosts
+
+Status: active
+Tags: [provisioning, bootstrap]
+Related: [MOD-001]
+Confidence: confirmed
+
+### Statement
+
+The collection provides a complete initial setup ("Ersteinrichtung") for
+Debian hosts via `bootstrap.yml` (packages, admin user, SSH, MOTD, sysctl,
+Docker, monitoring).
+
+### Rationale
+
+README.md: "bootstrap.yml | Vollständige Ersteinrichtung eines Debian-Hosts";
+README purpose statement: "Bereitstellung, Härtung, Aktualisierung und
+Überwachung von Debian-Hosts".
+
+### Acceptance Notes
+
+- Runs against the three sites in `inventory/`; composes docker and
+  monitoring roles with skip flags.
+
+<a id="req-002"></a>
+
+## REQ-002 - Docker Engine installation
+
+Status: active
+Tags: [docker]
+Related: [MOD-002]
+Confidence: confirmed
+
+### Statement
+
+Install Docker Engine from the official Docker repository
+(`playbooks/docker.yml` / role `docker`).
+
+### Rationale
+
+README playbook table: "docker | Docker Engine installieren".
+
+### Acceptance Notes
+
+- Official repository, not distribution packages.
+
+<a id="req-003"></a>
+
+## REQ-003 - Zabbix Agent 2 installation and registration
+
+Status: active
+Tags: [monitoring, zabbix]
+Related: [MOD-003, TECH-INTEGRATIONS-ZABBIX]
+Confidence: confirmed
+
+### Statement
+
+Install Zabbix Agent 2 and register the host on the Zabbix server
+(`playbooks/monitoring.yml` / role `monitoring`).
+
+### Rationale
+
+README playbook table: "monitoring | Zabbix Agent 2 installieren &
+registrieren".
+
+### Acceptance Notes
+
+- Includes TLS-PSK and Docker plugin support per implementation.
+
+<a id="req-004"></a>
+
+## REQ-004 - Package updates with healthcheck
+
+Status: active
+Tags: [updates, healthcheck]
+Related: [MOD-004, MOD-005]
+Confidence: confirmed
+
+### Statement
+
+Update Debian packages and verify running containers afterwards
+(`playbooks/os-updates-deb.yml`: roles `os-updates` + `healthcheck`).
+
+### Rationale
+
+README playbook table: "os-updates, healthcheck | Pakete aktualisieren +
+Healthcheck".
+
+### Acceptance Notes
+
+- Mirror switch, reboot and logging are part of the implemented update flow.
+
+<a id="req-005"></a>
+
+## REQ-005 - Hawser stack update
+
+Status: active
+Tags: [docker, hawser]
+Related: [MOD-006]
+Confidence: confirmed
+
+### Statement
+
+Update the Hawser Docker Compose stack (`playbooks/upgrade-hawser.yml` /
+role `hawser`).
+
+### Rationale
+
+README playbook table: "hawser | Hawser-Stack aktualisieren".
+
+### Acceptance Notes
+
+- None.
+
+<a id="req-006"></a>
+
+## REQ-006 - SSH key hardening
+
+Status: active
+Tags: [ssh, hardening]
+Related: [MOD-007]
+Confidence: confirmed
+
+### Statement
+
+Manage desired and undesired SSH keys on hosts
+(`playbooks/hardening/manage-ssh-keys.yml` / role `manage-ssh-keys`).
+
+### Rationale
+
+README playbook table: "manage-ssh-keys | SSH-Schlüssel hartieren"; role
+name/description in README roles table.
+
+### Acceptance Notes
+
+- None.