Add shared nginx-proxy role; deploy Hermes in Docker; rename Paperclip

nginx-proxy (new role):
- Shared nginx + certbot under /opt/nginx, replacing the copies that
  lived inside the Paperclip compose project
- Apps publish via tasks_from: add_vhost (cert marker -> issue cert ->
  write vhost -> nginx -t -> reload); a vhost that fails nginx -t is
  rolled back
- Certs issued one per domain via Cloudflare DNS challenge; domains
  registered as marker files in cert-domains/; optional LE staging
- Stock nginx.conf plus conf.d (directory mounts, not single-file
  mounts); catch-all server drops unknown Host/SNI
- Containers renamed to nginx and certbot

hermes_docker (new role):
- Official Hermes image, host networking, gateway and dashboard bound
  to loopback and published through nginx-proxy
- Dashboard login via basic-auth provider, secrets from the vault
- Main model set from hermes_model (fantasmic endpoint, key from vault);
  config.yaml overrides are merged from a 0600 staged file that is
  removed afterwards, so the key never appears in a command line
- Data dir owner-only (HERMES_HOME_MODE=0700)

paperclip-docker:
- Remove nginx, certbot and docker-compose download tasks; deploy with
  community.docker.docker_compose_v2 (idempotent, remove_orphans)
- Stop passing the Cloudflare token and certbot email to the Paperclip
  container via env_file
- Bind Postgres to 127.0.0.1 (host networking exposed it on all
  interfaces); stop chowning pgdata, which the postgres image owns
- Handler recreates the paperclip service so .env changes apply
- Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud

Playbooks:
- Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml
- deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker,
  CLI-based container checks (no Docker SDK dependency)
- Remove deploy-hermes.yml

Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging
(staging stays on until the switch to real certs).

ansible/playbooks/deploy_paperclip_stack.yml

@@ -1,5 +1,5 @@
 ---
-- name: Deploy Paperclip stack with nginx and certbot
+- name: Deploy Paperclip stack (behind the shared nginx-proxy)
   hosts: illuminations
   become: true
   vars_files:
@@ -8,77 +8,75 @@
 
   roles:
     - docker-host
+    - nginx-proxy        # must come before paperclip-docker (it publishes its vhost through it)
     - paperclip-docker
 
   post_tasks:
-    - name: Verify Paperclip stack is running
-      community.docker.docker_container_info:
-        name: "{{ item }}"
+    # CLI-based on purpose: community.docker.docker_container_info needs the
+    # Docker SDK for Python, which the paperclip-docker role no longer installs.
+    - name: Verify stack containers are running
+      ansible.builtin.command: "docker inspect -f '{% raw %}{{.State.Running}}{% endraw %}' {{ item }}"
       register: container_status
       loop:
+        - paperclip-db
         - paperclip
-        - paperclip-nginx
-        - paperclip-certbot
-      changed_when: false
-
-    - name: Fail if any container is not running
-      fail:
-        msg: "Container {{ item.item }} is not running or does not exist"
-      when: not item.exists or item.container.State.Running == false
-      loop: "{{ container_status.results }}"
+        - nginx
+        - certbot
       changed_when: false
+      failed_when: container_status.rc != 0 or container_status.stdout | trim != 'true'
+      loop_control:
+        label: "{{ item }}"
 
     - name: Verify Docker is available
-      command: docker --version
+      ansible.builtin.command: docker --version
       register: docker_version
       changed_when: false
 
     - name: Show Docker version
-      debug:
+      ansible.builtin.debug:
         msg: "Docker version: {{ docker_version.stdout }}"
 
     - name: Verify docker-compose plugin is available
-      command: docker compose version
+      ansible.builtin.command: docker compose version
       register: compose_version
       changed_when: false
       ignore_errors: true
 
     - name: Show docker-compose version
-      debug:
+      ansible.builtin.debug:
         msg: "Docker Compose version: {{ compose_version.stdout | default('docker-compose plugin not found') }}"
 
     - name: Display deployment summary
-      debug:
+      ansible.builtin.debug:
         msg: |
           Paperclip stack deployed successfully!
-          
+
           Access points:
             - HTTPS: https://{{ paperclip_domain }}
             - HTTP (redirects to HTTPS): http://{{ paperclip_domain }}
-          
+
           Services:
             - Paperclip: {{ paperclip_host }}:{{ paperclip_port }}
-            - nginx (reverse proxy): 0.0.0.0:443 / 0.0.0.0:80
+            - nginx (shared reverse proxy): 0.0.0.0:443 / 0.0.0.0:80, config in {{ nginx_proxy_conf_dir }}
             - certbot: Running certificate renewal checks
-          
+
           Data location:
             - {{ paperclip_base_path }}/data
-          
+
           Certificates:
-            - {{ paperclip_certs_dir }}/live/{{ paperclip_domain }}/
-          
+            - {{ nginx_proxy_certs_dir }}/live/{{ paperclip_domain }}/
+
           vLLM endpoint:
             - {{ vllm_endpoint }}
-          
+
           OpenCode configuration:
             - Config: {{ paperclip_base_path }}/.config/opencode/opencode.jsonc
             - Model: Gemma-4-26B (AWQ)
             - Endpoint: {{ vllm_endpoint }}/v1
-          
+
           Next steps:
             1. Verify DNS resolution for {{ paperclip_domain }}
             2. Visit https://{{ paperclip_domain }} to access Paperclip
             3. OpenCode should auto-initialize with vLLM at {{ vllm_endpoint }}
-            4. Set up Hermes Gateway on Mac Studio
+            4. Run day1_deploy_hermes_docker.yml (publishes its dashboard through the same nginx)
             5. Configure agents and skills
-