feat: add JMRI headless server role and main-street-station host

- New ansible/roles/jmri role: installs OpenJDK 21 headless, creates
  jmri service user, downloads JMRI 5.10, deploys JmriFaceless systemd unit
- Handles dialout group membership for serial device access
- Config restore task for post-reinstall recovery from GitHub backup
- host_vars/main-street-station: profile_id and serial device (TODO: fill in)
- Inventory: jmri_server group with main-street-station at 192.168.10.45
- Playbook: day1_deploy_jmri.yml (linux-baseline + jmri)

ansible/roles/jmri/defaults/main.yml

@@ -0,0 +1,25 @@
+---
+# JMRI version to install
+jmri_version: "5.10"
+jmri_install_dir: /opt/JMRI
+jmri_download_url: "https://github.com/JMRI/JMRI/releases/download/v{{ jmri_version }}/JMRI.{{ jmri_version }}+Rca461bd266.tgz"
+
+# Service user
+jmri_user: jmri
+jmri_group: jmri
+jmri_home: /home/jmri
+
+# Profile — override per-host in inventory
+# Find on the old box: ls ~/.jmri/profiles/
+jmri_profile_id: ""
+
+# Config restore source (path to the backed-up .jmri directory)
+jmri_config_src: ""
+
+# Ports (for documentation / firewall rules)
+jmri_json_port: 12080
+jmri_withrottle_port: 12090
+
+# USB serial device for NCE (set per-host in inventory)
+# e.g. /dev/ttyUSB0 or /dev/ttyACM0
+jmri_serial_device: /dev/ttyUSB0