rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/technical/modules/MOD-001-bootstrap-role.md

@@ -0,0 +1,65 @@
+---
+id: MOD-001
+type: module
+status: active
+title: Bootstrap Role
+created: 2026-09-09
+updated: 2026-09-09
+tags: [module, bootstrap, ansible]
+related: [MOD-002, MOD-003, REQ-001]
+source_paths:
+- roles/bootstrap/
+confidence: confirmed
+---
+
+# Bootstrap Role
+
+## Responsibility
+
+Full initial setup of a Debian host: packages, admin user, SSH, MOTD,
+keyboard layout, bashrc, sysctl; then composes Docker and monitoring.
+
+## Source Paths
+
+- `roles/bootstrap/tasks/main.yml` - orchestration only
+- Subtasks: `install-basicpackages.yml`, `create-admin-user.yml`,
+  `set-motd.yml`, `set-keyboardlayout.yml`, `install-openssh.yml`,
+  `configure-ssh.yml`, `add-ssh-keys.yml`, `setup-bashrc.yml`,
+  `configure-sysctl.yml`
+- Templates: `authorized_keys.j2`, `keyboard.j2`, `sshd.conf.j2`,
+  `sudoers-admin.j2`
+
+## Public Interfaces
+
+- Playbook: `bootstrap.yml` (top level, Debian guard, `become`, `user: admin`,
+  `vars_files: vault.yml`)
+- Skip flags: `skip_docker`, `skip_monitoring` (control role composition)
+- Tags: `motd`, `ssh`, `bashrc`, `sysctl`
+
+## Important Flows
+
+1. Basic packages → admin user (+sudo via `sudoers-admin.j2`, authorized
+   keys via `authorized_keys.j2`) → MOTD → keyboard layout.
+2. OpenSSH install, hardening config (`sshd.conf.j2`), authorized keys.
+3. bashrc, sysctl.
+4. `import_role: docker` (when `not skip_docker`), then
+   `import_role: monitoring` (when `not skip_monitoring`).
+
+## Dependencies
+
+- Composed roles: [docker](./MOD-002-docker-role.md),
+  [monitoring](./MOD-003-monitoring-role.md).
+- `admin_authorized_keys` (public keys, plaintext OK) from
+  `defaults/main.yml`; `admin_password` (SHA-512 hash) lives encrypted in
+  `vault.yml`, loaded via `vars_files` in `bootstrap.yml` (resolved
+  ALERT-20260909-001).
+
+## Tests
+
+- None automated; manual runs via `./execute.sh`.
+
+## Notes For Agents
+
+- `sshd` service name differs per host (`ssh_service_name`, set for `gitea`
+  and `ipam` in `inventory/cloudlorean.yml`).
+- Keep `tasks/main.yml` as pure import list when extending.