rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/technical/security.md

@@ -0,0 +1,69 @@
+---
+id: TECH-SECURITY
+type: technical
+status: active
+title: Security
+created: '2026-09-09'
+updated: '2026-09-09'
+tags:
+- technical
+- security
+related:
+- ALERT-20260909-001
+- ALERT-20260909-002
+- NFR-002
+- MOD-003
+- MOD-007
+source_paths:
+- vault.yml
+- roles/monitoring/tasks/configure-psk.yml
+- roles/bootstrap/defaults/main.yml
+- ansible.cfg
+confidence: confirmed
+---
+
+# Security
+
+## Secrets Handling
+
+- `vault.yml` (tracked, encrypted) holds `admin_password` (SHA-512 hash),
+  `monitoring_zabbix_api_password`, and Proxmox credentials
+  (`PROXMOX_USER_NAME`, `PROXMOX_USER_PASS`); it is loaded via playbook-level
+  `vars_files` in `bootstrap.yml` and `playbooks/monitoring.yml`.
+- Git-ignored (verified): `.vault_pass`, `setenv.sh` (Proxmox credentials),
+  `.zabbix-psk/` (per-host PSKs), `logs/`.
+- Resolved 2026-09-09: the `admin_password` SHA-512 hash that was committed
+  in plaintext in `roles/bootstrap/defaults/main.yml` and
+  `inventory/group_vars/external.yml` was moved to encrypted `vault.yml`
+  (see [ALERT-20260909-001](../alerts/ALERT-20260909-001.md)).
+
+## SSH Posture
+
+- Controller/transport: `host_key_checking = False`,
+  `StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null` (ansible.cfg,
+  execute.sh, Dockerfile). Deliberate for first-time provisioning; README
+  explicitly warns to restrict this in production.
+- Host hardening: `manage-ssh-keys` role enforces allow/deny key lists;
+  bootstrap deploys hardened `sshd.conf.j2` and per-host authorized keys.
+- Per-host exceptions: `ssh_service_name: ssh` on `gitea`/`ipam`.
+
+## Zabbix Agent TLS
+
+- PSK-only encryption (TLS connect + accept), 256-bit PSKs generated with
+  `openssl rand -hex 32` on the controller, persisted with umask 077 in a
+  0700 directory, deployed 0600 to the agent host. Identity = host name.
+
+## Risky Defaults (documented trade-offs)
+
+- `hawser_allow_insecure_no_auth: true` - Hawser standard mode without token
+  on non-loopback addresses; comment in defaults demands other network
+  protections.
+- `execute.sh` disables host key checking inside the runtime container.
+- Mirror rewrite runs with `ignore_errors: true` in os-updates.
+
+## Git Hygiene
+
+- Resolved 2026-09-09: the previously uncommitted change set (including the
+  `dmc12` → `cloudlorean` inventory rename and stale documentation) was
+  committed as one coherent change; see
+  [ALERT-20260909-002](../alerts/ALERT-20260909-002.md).