rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/technical/modules/MOD-003-monitoring-role.md

@@ -0,0 +1,77 @@
+---
+id: MOD-003
+type: module
+status: active
+title: Monitoring Role (Zabbix Agent 2)
+created: 2026-09-09
+updated: 2026-09-09
+tags: [module, monitoring, zabbix, ansible]
+related: [MOD-001, TECH-INTEGRATIONS-ZABBIX, REQ-003, NFR-002]
+source_paths:
+- roles/monitoring/
+confidence: confirmed
+---
+
+# Monitoring Role (Zabbix Agent 2)
+
+## Responsibility
+
+Install Zabbix Agent 2, configure TLS-PSK and the Docker plugin, and
+register/update the host on the Zabbix server via the API.
+
+## Source Paths
+
+- `roles/monitoring/tasks/main.yml` → `validate.yml`,
+  `install-repository.yml`, `install-agent.yml`, `configure-docker.yml`,
+  `configure-psk.yml`, `configure-agent.yml`, `register-host.yml`
+- Templates: `zabbix_agent2.conf.j2`, `docker.conf.j2`
+
+## Public Interfaces
+
+- Playbook: `playbooks/monitoring.yml` (loads `../vault.yml`)
+- Tag: `monitoring`
+- Key variables (`defaults/main.yml`, overridden per site in
+  `inventory/group_vars/<site>.yml`): `monitoring_zabbix_version` (7.0),
+  `monitoring_zabbix_passive_servers`, `monitoring_zabbix_active_servers`,
+  `monitoring_zabbix_api_url`, `monitoring_zabbix_api_user`,
+  `monitoring_zabbix_api_password` (vault), `monitoring_zabbix_register_host`,
+  `monitoring_zabbix_proxy` / `monitoring_zabbix_proxy_address`,
+  `monitoring_zabbix_host_groups`, `monitoring_zabbix_templates`,
+  `monitoring_zabbix_docker_templates`, PSK settings
+  (`monitoring_zabbix_psk_bits: 256`,
+  `monitoring_zabbix_psk_store: {{ role_path }}/../../.zabbix-psk`).
+
+## Important Flows
+
+1. Validate inputs → add repo.zabbix.com repo → install `zabbix-agent2`.
+2. Docker plugin config when `/var/run/docker.sock` exists.
+3. PSK: generate once on the controller (`openssl rand -hex 32`, umask 077,
+   `creates:` guard), persist under `.zabbix-psk/<hostname>.psk` (0700),
+   validate hex format/length, deploy to `/etc/zabbix/zabbix_agent2.psk`
+   (0600), notify restart handler.
+4. Agent config: TLS connect/accept = PSK, identity =
+   `monitoring_zabbix_host_name`, passive/active servers, listen port 10050.
+5. Registration: `community.zabbix.zabbix_host` over httpapi (connection
+   params derived from `monitoring_zabbix_api_url` via `urlsplit`), agent
+   interface from `ansible_host`, template union adds
+   `monitoring_zabbix_docker_templates` when the Docker socket is present,
+   `monitored_by` switches to proxy when `monitoring_zabbix_proxy` is set.
+
+## Dependencies
+
+- `community.zabbix` collection; vault variable
+  `monitoring_zabbix_api_password`.
+- Composed by [bootstrap](./MOD-001-bootstrap-role.md) unless
+  `skip_monitoring`.
+
+## Tests
+
+- None automated.
+
+## Notes For Agents
+
+- PSK store is controller-side state; never commit it (git-ignored). When
+  renaming a host, migrate/regenerate the PSK, otherwise registration
+  drifts (documented in AGENTS.md).
+- Template name mismatch between role default (`Docker by Zabbix agent2`)
+  and group_vars (`Docker by Zabbix agent 2`) - see open question OQ-005.