feat(semaphore): add config-as-code via Semaphore REST API

Adds an idempotent configuration pass that drives a freshly-deployed
Semaphore instance into its desired state via the REST API. Declared
in group_vars/all/semaphore.yml, applied by tasks/configure.yml,
toggled by semaphore_configure feature flag (default off).

Object types managed:
  - Project (mk-labs)
  - Keys (ansible-vault-pass, gitea-deploy, jarvis-ssh)
  - Repositories (homelab on gitea)
  - Inventories (production -> ansible/inventory.yml in homelab repo)
  - Environments (default with ANSIBLE_HOST_KEY_CHECKING=False)
  - Templates (day0_linux_baseline + variants, day1_deploy_semaphore)
    with survey vars for runtime parameters

Each object found-or-created by name; existing ones never modified.
no_log on token-bearing calls to keep secrets out of stdout.

Inputs (already in vault):
  vault_semaphore_api_token
  vault_jarvis_ssh_private_key
  vault_gitea_deploy_key
  vault_ansible_vault_password

ansible/roles/semaphore/tasks/main.yml

@@ -34,3 +34,8 @@
 - name: Verify Semaphore is reachable
   ansible.builtin.import_tasks: verify.yml
   tags: [semaphore, verify]
+
+- name: Apply Semaphore configuration (projects, keys, repos, templates)
+  ansible.builtin.import_tasks: configure.yml
+  when: semaphore_configure | default(false) | bool
+  tags: [semaphore, configure]