spaceship-earth: per-host Multica PAT, root LV growth, headless Obsidian (WDWL-22)

- provision-agent-host.yml: multica_pat now comes from
  vault_multica_pats[inventory_hostname_short], one daemon-<host> token per
  host. A pre_task asserts the key exists (never prints the value) so a
  missing entry fails by host name instead of as a no_log "censored".
- provision-wong-host.yml: spaceship-earth only. Grows the root partition,
  PV and LV/filesystem with growpart + community.general.lvg/lvol;
  idempotent (second run changed=0). Then applies obsidian_headless.
- roles/obsidian_headless: Obsidian's official headless Sync client
  (obsidian-headless 0.0.14) as system user obsync under a sandboxed
  systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/
  and wip/ obsync-only, inbox/ granted to multica via access + default
  ACLs, vault root traverse-only. Verifies the isolation as multica.
  Sign-in to Obsidian Sync stays manual (see the role README).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/obsidian_headless/tasks/preflight.yml

@@ -0,0 +1,33 @@
+---
+- name: Preflight | Read the Node.js version
+  ansible.builtin.command:
+    argv: ["{{ obsidian_headless_node_bin_dir }}/node", "--version"]
+  register: _obh_node
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Preflight | Require Node.js new enough for obsidian-headless
+  ansible.builtin.assert:
+    that:
+      - _obh_node.rc == 0
+      - (_obh_node.stdout | trim | regex_replace('^v', '')) is version(obsidian_headless_node_min_version, '>=')
+    fail_msg: >-
+      {{ obsidian_headless_node_bin_dir }}/node is missing or older than
+      {{ obsidian_headless_node_min_version }} (found:
+      {{ _obh_node.stdout | default('nothing') | trim }}). This role uses the
+      runtime multica_agent_host installs; run provision-agent-host.yml first.
+    quiet: true
+
+- name: Preflight | Look up the users granted shared folders
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ item }}"
+  loop: "{{ obsidian_headless_shared_folders | map(attribute='user') | unique | list }}"
+
+- name: Preflight | Require shared folders to stay disjoint from private ones
+  ansible.builtin.assert:
+    that:
+      - obsidian_headless_shared_folders | map(attribute='path') | intersect(obsidian_headless_private_folders) | length == 0
+    fail_msg: A folder cannot be both private and shared.
+    quiet: true