rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/technical/modules/MOD-002-docker-role.md

@@ -0,0 +1,52 @@
+---
+id: MOD-002
+type: module
+status: active
+title: Docker Role
+created: 2026-09-09
+updated: 2026-09-09
+tags: [module, docker, ansible]
+related: [MOD-001, MOD-006, REQ-002]
+source_paths:
+- roles/docker/
+confidence: confirmed
+---
+
+# Docker Role
+
+## Responsibility
+
+Install Docker Engine from the official Docker apt repository.
+
+## Source Paths
+
+- `roles/docker/tasks/main.yml` → `install-docker.yml`
+- Template: `roles/docker/templates/sources.list.j2`
+- Handlers: `roles/docker/handlers/main.yml`
+
+## Public Interfaces
+
+- Playbook: `playbooks/docker.yml`
+- Defaults: `docker_mirror` (download.docker.com/linux/debian),
+  `os_version_codename` (derived from `ansible_facts['distribution_release']`),
+  `docker_packages` (docker-ce, docker-ce-cli, containerd.io, buildx and
+  compose plugins).
+
+## Important Flows
+
+1. Set up the official Docker apt repository (key + `sources.list.j2`).
+2. Install `docker_packages` (handlers restart the service when needed).
+
+## Dependencies
+
+- Used standalone (`playbooks/docker.yml`) and composed by
+  [bootstrap](./MOD-001-bootstrap-role.md). Prerequisite for
+  [hawser](./MOD-006-hawser-role.md).
+
+## Tests
+
+- None automated.
+
+## Notes For Agents
+
+- Codename comes from host facts; no LXC-specific handling observed.