Add shared nginx-proxy role; deploy Hermes in Docker; rename Paperclip

nginx-proxy (new role):
- Shared nginx + certbot under /opt/nginx, replacing the copies that
  lived inside the Paperclip compose project
- Apps publish via tasks_from: add_vhost (cert marker -> issue cert ->
  write vhost -> nginx -t -> reload); a vhost that fails nginx -t is
  rolled back
- Certs issued one per domain via Cloudflare DNS challenge; domains
  registered as marker files in cert-domains/; optional LE staging
- Stock nginx.conf plus conf.d (directory mounts, not single-file
  mounts); catch-all server drops unknown Host/SNI
- Containers renamed to nginx and certbot

hermes_docker (new role):
- Official Hermes image, host networking, gateway and dashboard bound
  to loopback and published through nginx-proxy
- Dashboard login via basic-auth provider, secrets from the vault
- Main model set from hermes_model (fantasmic endpoint, key from vault);
  config.yaml overrides are merged from a 0600 staged file that is
  removed afterwards, so the key never appears in a command line
- Data dir owner-only (HERMES_HOME_MODE=0700)

paperclip-docker:
- Remove nginx, certbot and docker-compose download tasks; deploy with
  community.docker.docker_compose_v2 (idempotent, remove_orphans)
- Stop passing the Cloudflare token and certbot email to the Paperclip
  container via env_file
- Bind Postgres to 127.0.0.1 (host networking exposed it on all
  interfaces); stop chowning pgdata, which the postgres image owns
- Handler recreates the paperclip service so .env changes apply
- Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud

Playbooks:
- Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml
- deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker,
  CLI-based container checks (no Docker SDK dependency)
- Remove deploy-hermes.yml

Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging
(staging stays on until the switch to real certs).

ansible/roles/paperclip-docker/templates/docker-compose.yml.j2

@@ -3,6 +3,8 @@ services:
     image: postgres:16-alpine
     container_name: paperclip-db
     network_mode: host
+    # network_mode: host would otherwise expose Postgres on every interface
+    command: ["postgres", "-c", "listen_addresses=127.0.0.1"]
     environment:
       POSTGRES_USER: paperclip
       POSTGRES_PASSWORD: paperclip
@@ -23,12 +25,12 @@ services:
     env_file:
       - {{ paperclip_base_path }}/.env
     environment:
-      HOST: "127.0.0.1"
+      HOST: {{ paperclip_listen_host }}
       PAPERCLIP_HOME: /paperclip
       PAPERCLIP_PORT: {{ paperclip_port }}
       PAPERCLIP_PUBLIC_URL: "https://{{ paperclip_domain }}"
       PAPERCLIP_DEPLOYMENT_MODE: "{{ paperclip_deployment_mode }}"
-      PAPERCLIP_DEPLOYMENT_EXPOSURE: "private"
+ #     PAPERCLIP_DEPLOYMENT_EXPOSURE: "private"
       PAPERCLIP_ALLOWED_HOSTNAMES: "{{ paperclip_allowed_hostnames }}"
       DATABASE_URL: "postgresql://paperclip:paperclip@localhost:5432/paperclip"
       BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
@@ -50,43 +52,3 @@ services:
       timeout: 10s
       retries: 3
       start_period: 60s
-
-  certbot:
-    image: certbot/dns-cloudflare:latest
-    container_name: paperclip-certbot
-    volumes:
-      - {{ paperclip_certs_dir }}:/etc/letsencrypt
-      - {{ paperclip_base_path }}/certbot-init.sh:/certbot-init.sh:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    environment:
-      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
-      CERTBOT_EMAIL: ${CERTBOT_EMAIL}
-      PAPERCLIP_DOMAIN: ${PAPERCLIP_DOMAIN}
-    entrypoint: /bin/sh
-    command:
-      - -c
-      - |
-        /certbot-init.sh && while true; do certbot renew --quiet; sleep 12h; done
-    restart: unless-stopped
-
-  nginx:
-    image: nginx:latest
-    container_name: paperclip-nginx
-    network_mode: host
-    volumes:
-      - {{ paperclip_base_path }}/nginx.conf:/etc/nginx/nginx.conf:ro
-      - {{ paperclip_certs_dir }}:/etc/nginx/certs:ro
-    depends_on:
-      - certbot
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:80/"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-
-volumes:
-  paperclip_data:
-    driver: local
-