feat(honcho): add role + day1 playbook + traefik route for lincoln

Deploys Honcho (plastic-labs/honcho) as a rootful Podman + Quadlet
service on the lincoln VM (10.1.71.132). Three containers on a
user-defined network:

  - honcho-postgres  pgvector/pgvector:pg16
  - honcho-api       FastAPI on :8000
  - honcho-deriver   background worker for theory-of-mind derivations

LLM provider: Anthropic Claude (claude-sonnet-4-5). Switching providers
is two env-var changes — see README.

Traefik route hall-of-presidents.local.mk-labs.cloud -> lincoln:8000
added under boilerplates/traefik/dynamic/. JARVIS itself talks to
Honcho directly at lincoln:8000 (east-west); the Traefik alias exists
only for browser access to the Swagger /docs UI.

Requires three new vault entries before first run:
  - vault_honcho_database_password
  - vault_honcho_jwt_secret
  - vault_honcho_anthropic_api_key

boilerplates/traefik/dynamic/honcho.yml

@@ -0,0 +1,30 @@
+# {{ ansible_managed }}
+# Traefik dynamic config for Honcho on lincoln.
+# Routes hall-of-presidents.local.mk-labs.cloud -> lincoln:8000.
+#
+# Honcho is normally an east-west API (JARVIS talks to it directly), but
+# the operator wants browser access to the Swagger /docs UI, so the API
+# is exposed via Traefik. There is no separate dashboard endpoint —
+# /docs is the dashboard.
+#
+# No service-name alias: per the mk-labs east-west / north-south rule,
+# only the human-facing Traefik route gets a thematic name. JARVIS
+# accesses Honcho directly at http://lincoln:8000.
+
+http:
+  routers:
+    honcho:
+      rule: "Host(`hall-of-presidents.local.mk-labs.cloud`)"
+      entryPoints:
+        - websecure
+      service: honcho
+      tls:
+        certResolver: cloudflare
+      middlewares:
+        - security-headers
+
+  services:
+    honcho:
+      loadBalancer:
+        servers:
+          - url: "http://lincoln.local.mk-labs.cloud:8000"