spaceship-earth: per-host Multica PAT, root LV growth, headless Obsidian (WDWL-22)

- provision-agent-host.yml: multica_pat now comes from
  vault_multica_pats[inventory_hostname_short], one daemon-<host> token per
  host. A pre_task asserts the key exists (never prints the value) so a
  missing entry fails by host name instead of as a no_log "censored".
- provision-wong-host.yml: spaceship-earth only. Grows the root partition,
  PV and LV/filesystem with growpart + community.general.lvg/lvol;
  idempotent (second run changed=0). Then applies obsidian_headless.
- roles/obsidian_headless: Obsidian's official headless Sync client
  (obsidian-headless 0.0.14) as system user obsync under a sandboxed
  systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/
  and wip/ obsync-only, inbox/ granted to multica via access + default
  ACLs, vault root traverse-only. Verifies the isolation as multica.
  Sign-in to Obsidian Sync stays manual (see the role README).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/obsidian_headless/tasks/user.yml

@@ -0,0 +1,26 @@
+---
+- name: User | Create the group
+  ansible.builtin.group:
+    name: "{{ obsidian_headless_group }}"
+    system: true
+    state: present
+
+# nologin: nobody needs a shell as this user. `sudo -u obsync -H ob ...` runs
+# the command directly and does not consult the login shell.
+- name: User | Create the user
+  ansible.builtin.user:
+    name: "{{ obsidian_headless_user }}"
+    group: "{{ obsidian_headless_group }}"
+    home: "{{ obsidian_headless_home }}"
+    shell: /usr/sbin/nologin
+    system: true
+    create_home: true
+    state: present
+
+- name: User | Keep the home private (holds the Obsidian account token)
+  ansible.builtin.file:
+    path: "{{ obsidian_headless_home }}"
+    state: directory
+    owner: "{{ obsidian_headless_user }}"
+    group: "{{ obsidian_headless_group }}"
+    mode: "0700"