feat: add JMRI headless server role and main-street-station host

- New ansible/roles/jmri role: installs OpenJDK 21 headless, creates
  jmri service user, downloads JMRI 5.10, deploys JmriFaceless systemd unit
- Handles dialout group membership for serial device access
- Config restore task for post-reinstall recovery from GitHub backup
- host_vars/main-street-station: profile_id and serial device (TODO: fill in)
- Inventory: jmri_server group with main-street-station at 192.168.10.45
- Playbook: day1_deploy_jmri.yml (linux-baseline + jmri)

ansible/roles/jmri/templates/jmri.service.j2

@@ -0,0 +1,35 @@
+[Unit]
+Description=JMRI Server (JmriFaceless)
+Documentation=https://www.jmri.org/
+After=network.target
+# Give USB devices time to enumerate after boot
+After=dev-{{ jmri_serial_device | basename }}.device
+Wants=dev-{{ jmri_serial_device | basename }}.device
+
+[Service]
+Type=simple
+User={{ jmri_user }}
+Group={{ jmri_group }}
+WorkingDirectory={{ jmri_install_dir }}
+
+# JmriFaceless requires a profile ID
+# Find yours: ls ~/.jmri/profiles/
+ExecStart={{ jmri_install_dir }}/JmriFaceless --profile={{ jmri_profile_id }}
+
+# Restart on failure, not on clean exit (e.g. intentional shutdown from Jython)
+Restart=on-failure
+RestartSec=10
+
+# Give hardware time to settle before retry
+TimeoutStartSec=30
+
+# Logging — view with: journalctl -u jmri -f
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=jmri
+
+# Serial device access
+SupplementaryGroups=dialout
+
+[Install]
+WantedBy=multi-user.target