Add shared nginx-proxy role; deploy Hermes in Docker; rename Paperclip

nginx-proxy (new role):
- Shared nginx + certbot under /opt/nginx, replacing the copies that
  lived inside the Paperclip compose project
- Apps publish via tasks_from: add_vhost (cert marker -> issue cert ->
  write vhost -> nginx -t -> reload); a vhost that fails nginx -t is
  rolled back
- Certs issued one per domain via Cloudflare DNS challenge; domains
  registered as marker files in cert-domains/; optional LE staging
- Stock nginx.conf plus conf.d (directory mounts, not single-file
  mounts); catch-all server drops unknown Host/SNI
- Containers renamed to nginx and certbot

hermes_docker (new role):
- Official Hermes image, host networking, gateway and dashboard bound
  to loopback and published through nginx-proxy
- Dashboard login via basic-auth provider, secrets from the vault
- Main model set from hermes_model (fantasmic endpoint, key from vault);
  config.yaml overrides are merged from a 0600 staged file that is
  removed afterwards, so the key never appears in a command line
- Data dir owner-only (HERMES_HOME_MODE=0700)

paperclip-docker:
- Remove nginx, certbot and docker-compose download tasks; deploy with
  community.docker.docker_compose_v2 (idempotent, remove_orphans)
- Stop passing the Cloudflare token and certbot email to the Paperclip
  container via env_file
- Bind Postgres to 127.0.0.1 (host networking exposed it on all
  interfaces); stop chowning pgdata, which the postgres image owns
- Handler recreates the paperclip service so .env changes apply
- Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud

Playbooks:
- Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml
- deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker,
  CLI-based container checks (no Docker SDK dependency)
- Remove deploy-hermes.yml

Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging
(staging stays on until the switch to real certs).

ansible/host_vars/illuminations/host_vars_illuminations.yml

@@ -1,6 +1,6 @@
 ---
 # Paperclip Docker deployment
-paperclip_domain: muppet-vision.wdw-labs.cloud
+paperclip_domain: cranium-command.wdw-labs.cloud
 paperclip_base_path: /opt/paperclip
 paperclip_port: 3100
 certbot_email: ryan.blundon@protonmail.com
@@ -8,6 +8,12 @@ certbot_email: ryan.blundon@protonmail.com
 # vLLM inference endpoint (local)
 vllm_endpoint: "http://127.0.0.1:8000"
 
+hermes_model:
+  provider: custom
+  default: Gemma-4-26B-A4B-Hermes-VLM-MLX      # from http://fantasmic.wdw-labs.cloud:8000/v1/models
+  base_url: http://fantasmic.wdw-labs.cloud:8000/v1
+  api_key: "{{ vault_fantasmic_api_key }}"
+
 # # DNS entries (if using your existing dns-manager role)
 # dns_entries:
 #   - name: illuminations

ansible/host_vars/illuminations/vars.yml

@@ -1,7 +1,7 @@
 ---
 # ------------------------------------------------------------------------------
-# FILE: ansible/host_vars/astro_orbiter/vars.yml
-# HOST: astro-orbiter (10.1.71.130)
+# FILE: ansible/host_vars/illuminations/vars.yml
+# HOST: illuminations (10.1.71.130)
 # ROLE: llama.cpp LLM inference host — Ryzen 7 5800XT / RTX 3090 (ATX rebuild,
 #       2026-08-04). Superseded the prior AMD RX 5700 / Ollama config below;
 #       drive was transplanted into new hardware, not reinstalled.
@@ -234,7 +234,11 @@ vllm_service_enabled: true
 vllm_service_state: started
 
 # Paperclip Docker deployment
-paperclip_domain: muppet-vision.wdw-labs.cloud
-paperclip_base_path: /opt/paperclip
-paperclip_port: 3100
-certbot_email: ryan.blundon@protonmail.com
+nginx_proxy_certbot_email: ryan.blundon@protonmail.com
+nginx_proxy_certbot_staging: true # remove after first successful real issuance
+
+hermes_model:
+  provider: custom
+  default: Gemma-4-26B-A4B-Hermes-VLM-MLX      # from http://fantasmic.wdw-labs.cloud:8000/v1/models
+  base_url: http://fantasmic.wdw-labs.cloud:8000/v1
+  api_key: "{{ vault_fantasmic_api_key }}"