feat(honcho): add role + day1 playbook + traefik route for lincoln

Deploys Honcho (plastic-labs/honcho) as a rootful Podman + Quadlet
service on the lincoln VM (10.1.71.132). Three containers on a
user-defined network:

  - honcho-postgres  pgvector/pgvector:pg16
  - honcho-api       FastAPI on :8000
  - honcho-deriver   background worker for theory-of-mind derivations

LLM provider: Anthropic Claude (claude-sonnet-4-5). Switching providers
is two env-var changes — see README.

Traefik route hall-of-presidents.local.mk-labs.cloud -> lincoln:8000
added under boilerplates/traefik/dynamic/. JARVIS itself talks to
Honcho directly at lincoln:8000 (east-west); the Traefik alias exists
only for browser access to the Swagger /docs UI.

Requires three new vault entries before first run:
  - vault_honcho_database_password
  - vault_honcho_jwt_secret
  - vault_honcho_anthropic_api_key

ansible/roles/honcho/tasks/main.yml

@@ -0,0 +1,42 @@
+---
+# ============================================================================
+# honcho / main entrypoint
+# ----------------------------------------------------------------------------
+# Order matters:
+#   1. Podman + Quadlet support installed and ready
+#   2. Network created (containers reference it by name)
+#   3. Volumes created (postgres data)
+#   4. Postgres started (Honcho API + deriver depend on it being ready)
+#   5. Honcho API started
+#   6. Honcho deriver worker started
+#   7. Verify reachable on listen port
+# ============================================================================
+
+- name: Install Podman and dependencies
+  ansible.builtin.import_tasks: podman.yml
+  tags: [honcho, podman]
+
+- name: Ensure podman network exists
+  ansible.builtin.import_tasks: network.yml
+  tags: [honcho, network]
+
+- name: Ensure podman volumes exist
+  ansible.builtin.import_tasks: volumes.yml
+  tags: [honcho, volumes]
+
+- name: Deploy PostgreSQL (pgvector) container
+  ansible.builtin.import_tasks: postgres.yml
+  tags: [honcho, postgres]
+
+- name: Deploy Honcho API container
+  ansible.builtin.import_tasks: api.yml
+  tags: [honcho, api]
+
+- name: Deploy Honcho deriver worker
+  ansible.builtin.import_tasks: deriver.yml
+  when: honcho_deriver_enabled | bool
+  tags: [honcho, deriver]
+
+- name: Verify Honcho is reachable
+  ansible.builtin.import_tasks: verify.yml
+  tags: [honcho, verify]