spaceship-earth: per-host Multica PAT, root LV growth, headless Obsidian (WDWL-22)

- provision-agent-host.yml: multica_pat now comes from
  vault_multica_pats[inventory_hostname_short], one daemon-<host> token per
  host. A pre_task asserts the key exists (never prints the value) so a
  missing entry fails by host name instead of as a no_log "censored".
- provision-wong-host.yml: spaceship-earth only. Grows the root partition,
  PV and LV/filesystem with growpart + community.general.lvg/lvol;
  idempotent (second run changed=0). Then applies obsidian_headless.
- roles/obsidian_headless: Obsidian's official headless Sync client
  (obsidian-headless 0.0.14) as system user obsync under a sandboxed
  systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/
  and wip/ obsync-only, inbox/ granted to multica via access + default
  ACLs, vault root traverse-only. Verifies the isolation as multica.
  Sign-in to Obsidian Sync stays manual (see the role README).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/obsidian_headless/templates/obsidian-sync.service.j2

@@ -0,0 +1,34 @@
+# {{ ansible_managed }}
+[Unit]
+Description=Obsidian Headless Sync ({{ obsidian_headless_vault_path }})
+Documentation=https://obsidian.md/help/sync/headless
+Wants=network-online.target
+After=network-online.target
+# Inert until `ob login` and `ob sync-setup` have been run by hand.
+ConditionPathExists={{ obsidian_headless_home }}/.config/obsidian-headless/auth_token
+ConditionDirectoryNotEmpty={{ obsidian_headless_home }}/.config/obsidian-headless/sync
+
+[Service]
+Type=simple
+User={{ obsidian_headless_user }}
+Group={{ obsidian_headless_group }}
+# Everything Sync creates is private unless it lands under a folder with a
+# default ACL (the shared folders), where the umask does not apply.
+UMask=0077
+Environment=HOME={{ obsidian_headless_home }}
+Environment=PATH={{ obsidian_headless_node_bin_dir }}:/usr/bin:/bin
+WorkingDirectory={{ obsidian_headless_vault_path }}
+ExecStart={{ obsidian_headless_link_dir }}/ob sync --continuous --path {{ obsidian_headless_vault_path }}
+Restart=on-failure
+RestartSec=30
+# 2: missing encryption key, 3: no sync configuration. Both need a human.
+RestartPreventExitStatus=2 3
+
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths={{ obsidian_headless_vault_path }} {{ obsidian_headless_home }}
+
+[Install]
+WantedBy=multi-user.target