feat(honcho): add role + day1 playbook + traefik route for lincoln

Deploys Honcho (plastic-labs/honcho) as a rootful Podman + Quadlet
service on the lincoln VM (10.1.71.132). Three containers on a
user-defined network:

  - honcho-postgres  pgvector/pgvector:pg16
  - honcho-api       FastAPI on :8000
  - honcho-deriver   background worker for theory-of-mind derivations

LLM provider: Anthropic Claude (claude-sonnet-4-5). Switching providers
is two env-var changes — see README.

Traefik route hall-of-presidents.local.mk-labs.cloud -> lincoln:8000
added under boilerplates/traefik/dynamic/. JARVIS itself talks to
Honcho directly at lincoln:8000 (east-west); the Traefik alias exists
only for browser access to the Swagger /docs UI.

Requires three new vault entries before first run:
  - vault_honcho_database_password
  - vault_honcho_jwt_secret
  - vault_honcho_anthropic_api_key

ansible/roles/honcho/defaults/main.yml

@@ -0,0 +1,109 @@
+---
+# ============================================================================
+# honcho role defaults
+# ============================================================================
+# Deploys Honcho (https://honcho.dev — plastic-labs/honcho) as a rootful
+# Podman + Quadlet service on a single VM. Three containers:
+#
+#   honcho-postgres   pgvector-enabled PostgreSQL backing store
+#   honcho-api        FastAPI server on :8000  (theory-of-mind read/write)
+#   honcho-deriver    background worker that consumes the queue and calls
+#                     out to the configured LLM provider for derivations
+#
+# All three share a user-defined podman network. State persists to named
+# volumes. Traefik on lightning-lane terminates TLS and routes the
+# `hall-of-presidents.local.mk-labs.cloud` host to honcho-api:8000.
+#
+# LLM provider for the first deployment is Anthropic Claude. Switching
+# providers is a single env-var change (see DERIVER_MODEL_CONFIG__TRANSPORT
+# / SUMMARY_MODEL_CONFIG__TRANSPORT and the LLM_*_API_KEY variables).
+# ============================================================================
+
+# ---------------------------------------------------------------------------
+# Image pinning
+# ---------------------------------------------------------------------------
+# Honcho does not yet publish a Docker Hub image we trust; we use the
+# GitHub Container Registry build. Pin to a digest-stable tag.
+honcho_image: "ghcr.io/plastic-labs/honcho:latest"
+# pgvector/pgvector image follows the upstream postgres version channel.
+honcho_postgres_image: "docker.io/pgvector/pgvector:pg16"
+
+# ---------------------------------------------------------------------------
+# Container & network identifiers
+# ---------------------------------------------------------------------------
+honcho_container_name: honcho-api
+honcho_deriver_container_name: honcho-deriver
+honcho_postgres_container_name: honcho-postgres
+honcho_network_name: honcho-net
+
+# Named podman volumes
+honcho_postgres_volume: honcho_postgres_data
+
+# ---------------------------------------------------------------------------
+# Networking
+# ---------------------------------------------------------------------------
+# Honcho's FastAPI default port is 8000. Bind to 0.0.0.0 so Traefik on
+# lightning-lane can reach it; auth is enabled (JWT) so the open port is
+# not an open door.
+honcho_listen_address: "0.0.0.0"
+honcho_listen_port: 8000
+
+# Public-facing URL used for absolute links / OIDC callbacks.
+# Leave EMPTY to make Honcho host-agnostic — FastAPI emits relative URLs.
+# Set to a fully-qualified URL only if a specific feature requires it.
+honcho_web_url: ""
+
+# ---------------------------------------------------------------------------
+# PostgreSQL configuration
+# ---------------------------------------------------------------------------
+honcho_db_user: honcho
+honcho_db_name: honcho
+# honcho_db_password sourced from vault below
+
+# pgvector-enabled Postgres uses the same env vars as the stock image
+honcho_postgres_initdb_args: "--encoding=UTF8 --locale=C"
+
+# ---------------------------------------------------------------------------
+# LLM provider configuration
+# ---------------------------------------------------------------------------
+# Supported transports: openai, anthropic, gemini. We start with anthropic
+# and can flip to a local OpenAI-compatible endpoint later by changing
+# these two values plus the API-key env-var name.
+honcho_llm_transport: "anthropic"
+honcho_deriver_model: "claude-sonnet-4-5"
+honcho_summary_model: "claude-sonnet-4-5"
+honcho_dialectic_model: "claude-sonnet-4-5"
+
+# Deriver tuning — number of workers, polling cadence, etc. Conservative
+# defaults appropriate for a small homelab deployment.
+honcho_deriver_enabled: true
+honcho_deriver_workers: 1
+honcho_deriver_polling_seconds: "1.0"
+
+# ---------------------------------------------------------------------------
+# Auth
+# ---------------------------------------------------------------------------
+# AUTH_USE_AUTH=true means clients must present a JWT signed with
+# AUTH_JWT_SECRET. The secret lives in vault.
+honcho_auth_enabled: true
+
+# ---------------------------------------------------------------------------
+# Vault inputs (defined in group_vars/all/vault, encrypted with ansible-vault)
+# ---------------------------------------------------------------------------
+# vault_honcho_database_password      - postgres role password
+# vault_honcho_jwt_secret             - 32+ byte random string for JWT signing
+# vault_honcho_anthropic_api_key      - Anthropic API key for Claude calls
+honcho_db_password: "{{ vault_honcho_database_password }}"
+honcho_jwt_secret: "{{ vault_honcho_jwt_secret }}"
+honcho_anthropic_api_key: "{{ vault_honcho_anthropic_api_key }}"
+
+# ---------------------------------------------------------------------------
+# Health check
+# ---------------------------------------------------------------------------
+honcho_health_check_retries: 30
+honcho_health_check_delay: 2
+
+# ---------------------------------------------------------------------------
+# Quadlet location (rootful)
+# ---------------------------------------------------------------------------
+honcho_quadlet_dir: /etc/containers/systemd