spaceship-earth: per-host Multica PAT, root LV growth, headless Obsidian (WDWL-22)

- provision-agent-host.yml: multica_pat now comes from
  vault_multica_pats[inventory_hostname_short], one daemon-<host> token per
  host. A pre_task asserts the key exists (never prints the value) so a
  missing entry fails by host name instead of as a no_log "censored".
- provision-wong-host.yml: spaceship-earth only. Grows the root partition,
  PV and LV/filesystem with growpart + community.general.lvg/lvol;
  idempotent (second run changed=0). Then applies obsidian_headless.
- roles/obsidian_headless: Obsidian's official headless Sync client
  (obsidian-headless 0.0.14) as system user obsync under a sandboxed
  systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/
  and wip/ obsync-only, inbox/ granted to multica via access + default
  ACLs, vault root traverse-only. Verifies the isolation as multica.
  Sign-in to Obsidian Sync stays manual (see the role README).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/obsidian_headless/tasks/service.yml

@@ -0,0 +1,31 @@
+---
+- name: Service | Install the unit
+  ansible.builtin.template:
+    src: obsidian-sync.service.j2
+    dest: "/etc/systemd/system/{{ obsidian_headless_service_name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart obsidian sync
+
+- name: Service | Enable it at boot
+  ansible.builtin.systemd_service:
+    name: "{{ obsidian_headless_service_name }}"
+    enabled: "{{ obsidian_headless_service_enabled | bool }}"
+    daemon_reload: true
+
+# Starting it before the manual sign-in would be a no-op (its conditions fail)
+# that reports "changed" on every run. Start it only once it can actually sync.
+- name: Service | Check whether the manual sign-in and vault setup are done
+  ansible.builtin.find:
+    paths: "{{ obsidian_headless_home }}/.config/obsidian-headless/sync"
+    file_type: directory
+  register: _obh_sync_configs
+
+- name: Service | Start it once a vault is set up
+  ansible.builtin.systemd_service:
+    name: "{{ obsidian_headless_service_name }}"
+    state: started
+  when:
+    - obsidian_headless_service_enabled | bool
+    - _obh_sync_configs.matched | default(0) > 0