feat: add JMRI headless server role and main-street-station host

- New ansible/roles/jmri role: installs OpenJDK 21 headless, creates
  jmri service user, downloads JMRI 5.10, deploys JmriFaceless systemd unit
- Handles dialout group membership for serial device access
- Config restore task for post-reinstall recovery from GitHub backup
- host_vars/main-street-station: profile_id and serial device (TODO: fill in)
- Inventory: jmri_server group with main-street-station at 192.168.10.45
- Playbook: day1_deploy_jmri.yml (linux-baseline + jmri)

ansible/roles/jmri/tasks/main.yml

@@ -0,0 +1,87 @@
+---
+- name: Install Java runtime (headless)
+  ansible.builtin.apt:
+    name: openjdk-21-jre-headless
+    state: present
+    update_cache: true
+
+- name: Create JMRI system group
+  ansible.builtin.group:
+    name: "{{ jmri_group }}"
+    state: present
+    system: true
+
+- name: Create JMRI service user
+  ansible.builtin.user:
+    name: "{{ jmri_user }}"
+    group: "{{ jmri_group }}"
+    home: "{{ jmri_home }}"
+    shell: /usr/sbin/nologin
+    system: true
+    create_home: true
+    state: present
+
+- name: Add JMRI user to dialout group (serial device access)
+  ansible.builtin.user:
+    name: "{{ jmri_user }}"
+    groups: dialout
+    append: true
+
+- name: Check if JMRI is already installed at correct version
+  ansible.builtin.stat:
+    path: "{{ jmri_install_dir }}/JmriFaceless"
+  register: jmri_binary
+
+- name: Download JMRI release archive
+  ansible.builtin.get_url:
+    url: "{{ jmri_download_url }}"
+    dest: /tmp/JMRI-{{ jmri_version }}.tgz
+    mode: '0644'
+  when: not jmri_binary.stat.exists
+
+- name: Create JMRI install directory
+  ansible.builtin.file:
+    path: "{{ jmri_install_dir }}"
+    state: directory
+    owner: "{{ jmri_user }}"
+    group: "{{ jmri_group }}"
+    mode: '0755'
+
+- name: Extract JMRI archive
+  ansible.builtin.unarchive:
+    src: /tmp/JMRI-{{ jmri_version }}.tgz
+    dest: "{{ jmri_install_dir }}"
+    remote_src: true
+    owner: "{{ jmri_user }}"
+    group: "{{ jmri_group }}"
+    extra_opts: ['--strip-components=1']
+  when: not jmri_binary.stat.exists
+
+- name: Restore JMRI config from backup
+  ansible.builtin.copy:
+    src: "{{ jmri_config_src }}/"
+    dest: "{{ jmri_home }}/.jmri/"
+    owner: "{{ jmri_user }}"
+    group: "{{ jmri_group }}"
+    mode: '0644'
+    directory_mode: '0755'
+  when: jmri_config_src | length > 0
+  notify: Restart jmri
+
+- name: Deploy JmriFaceless systemd unit
+  ansible.builtin.template:
+    src: jmri.service.j2
+    dest: /etc/systemd/system/jmri.service
+    owner: root
+    group: root
+    mode: '0644'
+  notify:
+    - Reload systemd
+    - Restart jmri
+
+- name: Enable and start JMRI service
+  ansible.builtin.systemd:
+    name: jmri
+    enabled: true
+    state: started
+    daemon_reload: true