feat: Add paperclip-docker Ansible role for RTX 3090

Deploy Paperclip AI with PostgreSQL, nginx reverse proxy, and Cloudflare
SSL/TLS on illuminations.wdw-labs.cloud. Configured for local_trusted
mode (LAN-only, no auth) with host networking and auto-generated secrets.

Stack: PostgreSQL 16 + Paperclip + nginx + certbot
Hostname: muppet-vision.wdw-labs.cloud
vLLM endpoint: localhost:8000 (DeepSeek-R1-32B Q4)

ansible/roles/paperclip-docker/defaults/main.yml

@@ -0,0 +1,30 @@
+---
+# Paperclip deployment paths and configuration
+paperclip_base_path: /opt/paperclip
+paperclip_data_dir: "{{ paperclip_base_path }}/data"
+paperclip_certs_dir: "{{ paperclip_base_path }}/certs"
+paperclip_port: 3100
+paperclip_domain: muppet-vision.wdw-labs.cloud
+paperclip_host: 127.0.0.1
+
+# Paperclip allowed hostnames (space or comma-separated)
+# Includes: domain name, localhost (for internal/local access), and client IP
+paperclip_allowed_hostnames: "{{ paperclip_domain }} localhost 192.168.10.50"
+
+# Deployment mode: authenticated (requires login) or local_trusted (no auth, trusted network)
+paperclip_deployment_mode: "local_trusted"
+
+# Reverse proxy configuration
+nginx_port: 443
+nginx_http_port: 80
+
+# HTTPS/SSL configuration
+certbot_email: admin@wdw-labs.cloud
+certbot_provider: cloudflare
+
+# Inference endpoint (vLLM or remote OpenAI-compatible)
+vllm_endpoint: "http://127.0.0.1:8000"
+
+# NOTE: Authentication secrets (BETTER_AUTH_SECRET, PAPERCLIP_AGENT_JWT_SECRET)
+#       are auto-generated during deployment and stored in .env (mode 0600)
+#       No need to specify them here — they're created with: openssl rand -hex 24