feat(lab-09): Ansible playbook to rebuild the server in one command

[0x48core]

• site.yml: detects fresh (root:22) vs hardened (admin:ssh_port) by a real SSH login, then runs roles common, users, firewall, ssh, fail2ban, docker, opsforge; idempotent (second run changed=0)
• ssh role: validate with sshd -t, restart (socket-aware), carry the host key to the new port in known_hosts, reconnect, close port 22
• opsforge role: deploy user, proxy network, Traefik from stacks/ with Let's Encrypt merged in when traefik_acme_email is set, hello-api files and .env for deploy.sh
• Inventories: test (fake VPS, test values) and production templates; real hosts.yml and vault.yml git-ignored
• test/fake-vps.sh: disposable Ubuntu 24.04 systemd container with SSH and Docker-in-Docker
• Stacks: router hostnames use ${DOMAIN:-opsforge.localhost}
• Lab 09 guide and knowledge base; roadmap updated