rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/technical/modules/MOD-007-manage-ssh-keys-role.md

@@ -0,0 +1,58 @@
+---
+id: MOD-007
+type: module
+status: active
+title: Manage SSH Keys Role
+created: 2026-09-09
+updated: 2026-09-09
+tags: [module, ssh, hardening, ansible]
+related: [REQ-006, ALERT-20260909-001]
+source_paths:
+- roles/manage-ssh-keys/
+confidence: confirmed
+---
+
+# Manage SSH Keys Role
+
+## Responsibility
+
+Harden SSH access by enforcing an allow list (`good_keys`) and removing
+deny-listed keys (`bad_keys`) from the target user's authorized keys.
+
+## Source Paths
+
+- `roles/manage-ssh-keys/tasks/main.yml` → `validate-authorized-keys.yml`,
+  `add-goodkeys.yml`, `remove-badkeys.yml`
+- Handlers: `roles/manage-ssh-keys/handlers/main.yml`
+
+## Public Interfaces
+
+- Playbook: `playbooks/hardening/manage-ssh-keys.yml`
+  (binds the role directly; **no Debian guard, no `become`**)
+- Key variables: `ssh_user` (admin), `good_keys` (allow list),
+  `bad_keys` (deny list; supports env-provided JSON overrides via commented
+  vars in the playbook).
+- Conditional execution: `good_keys.defined and good_keys | length > 0`
+  (same for `bad_keys`).
+
+## Important Flows
+
+1. Validate/ensure `~/.ssh` of the logged-in user (0700).
+2. Add `good_keys` to authorized keys.
+3. Remove `bad_keys` from authorized keys.
+
+## Dependencies
+
+- None (ansible.builtin).
+
+## Tests
+
+- None automated.
+
+## Notes For Agents
+
+- The playbook deviates from the documented convention (Debian guard,
+  `become: true`); treat as an intentional gap to confirm before adding
+  more hardening playbooks.
+- Keys in `defaults/main.yml` are public keys (not secrets); the same allow
+  list also exists in `roles/bootstrap/defaults/main.yml`.