Add shared nginx-proxy role; deploy Hermes in Docker; rename Paperclip

nginx-proxy (new role):
- Shared nginx + certbot under /opt/nginx, replacing the copies that
  lived inside the Paperclip compose project
- Apps publish via tasks_from: add_vhost (cert marker -> issue cert ->
  write vhost -> nginx -t -> reload); a vhost that fails nginx -t is
  rolled back
- Certs issued one per domain via Cloudflare DNS challenge; domains
  registered as marker files in cert-domains/; optional LE staging
- Stock nginx.conf plus conf.d (directory mounts, not single-file
  mounts); catch-all server drops unknown Host/SNI
- Containers renamed to nginx and certbot

hermes_docker (new role):
- Official Hermes image, host networking, gateway and dashboard bound
  to loopback and published through nginx-proxy
- Dashboard login via basic-auth provider, secrets from the vault
- Main model set from hermes_model (fantasmic endpoint, key from vault);
  config.yaml overrides are merged from a 0600 staged file that is
  removed afterwards, so the key never appears in a command line
- Data dir owner-only (HERMES_HOME_MODE=0700)

paperclip-docker:
- Remove nginx, certbot and docker-compose download tasks; deploy with
  community.docker.docker_compose_v2 (idempotent, remove_orphans)
- Stop passing the Cloudflare token and certbot email to the Paperclip
  container via env_file
- Bind Postgres to 127.0.0.1 (host networking exposed it on all
  interfaces); stop chowning pgdata, which the postgres image owns
- Handler recreates the paperclip service so .env changes apply
- Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud

Playbooks:
- Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml
- deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker,
  CLI-based container checks (no Docker SDK dependency)
- Remove deploy-hermes.yml

Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging
(staging stays on until the switch to real certs).

ansible/roles/paperclip-docker/defaults/main.yml

@@ -2,31 +2,30 @@
 # Paperclip deployment paths and configuration
 paperclip_base_path: /opt/paperclip
 paperclip_data_dir: "{{ paperclip_base_path }}/data"
-paperclip_certs_dir: "{{ paperclip_base_path }}/certs"
 paperclip_port: 3100
-paperclip_domain: muppet-vision.wdw-labs.cloud
-paperclip_host: muppet-vision.wdw-labs.cloud
+paperclip_domain: cranium-command.wdw-labs.cloud
+paperclip_host: cranium-command.wdw-labs.cloud
+# paperclip_listen_host: 127.0.0.1 # Bootstrap local deployment
+paperclip_listen_host: 0.0.0.0 # Switch to this host after CEO is functional on local model
 
 # Paperclip allowed hostnames (space or comma-separated)
 # Includes: domain name, localhost (for internal/local access), and client IP
 paperclip_allowed_hostnames: "{{ paperclip_domain }} localhost 192.168.10.50"
 
 # Deployment mode: authenticated (requires login) or local_trusted (no auth, trusted network)
-paperclip_deployment_mode: "authenticated"
+# paperclip_deployment_mode: "local_trusted" # Bootstrap local deployment
+paperclip_deployment_mode: "authenticated" # Switch to this model after CEO is functional on local model
 
-# Reverse proxy configuration
-nginx_port: 443
-nginx_http_port: 80
+# TLS / reverse proxy are handled by the nginx-proxy role (/opt/nginx).
+# Set nginx_proxy_certbot_email in host_vars; run day1_deploy_nginx_proxy.yml first.
 
-# HTTPS/SSL configuration
-certbot_email: ryan.blundon@protonmail.com
-certbot_provider: cloudflare
-
-# Inference endpoint (vLLM or remote OpenAI-compatible)
-vllm_endpoint: "http://127.0.0.1:8000"
+# Inference endpoints (vLLM or remote OpenAI-compatible)
+illuminations_endpoint: "http://illuminations:8000"
 fantasmic_endpoint: "http://fantasmic.wdw-labs.cloud:8000"
-wishes_endpoint: "http://fantasmic.wdw-labs.cloud:8000"
+wishes_endpoint: "http://wishes.wdw-labs.cloud:8000"
 
-# NOTE: Authentication secrets (BETTER_AUTH_SECRET, PAPERCLIP_AGENT_JWT_SECRET)
-#       are auto-generated during deployment and stored in .env (mode 0600)
-#       No need to specify them here — they're created with: openssl rand -hex 24
+# NOTE: Secrets come from the ansible vault and are written to .env (mode 0600):
+#   vault_better_auth_secret, vault_paperclip_agent_jwt_secret,
+#   vault_illuminations_api_key, vault_fantasmic_api_key
+# Everything in .env is passed into the Paperclip container (env_file), so only
+# put values here that Paperclip itself should be able to read.