feat: Add paperclip-docker Ansible role for RTX 3090

Deploy Paperclip AI with PostgreSQL, nginx reverse proxy, and Cloudflare
SSL/TLS on illuminations.wdw-labs.cloud. Configured for local_trusted
mode (LAN-only, no auth) with host networking and auto-generated secrets.

Stack: PostgreSQL 16 + Paperclip + nginx + certbot
Hostname: muppet-vision.wdw-labs.cloud
vLLM endpoint: localhost:8000 (DeepSeek-R1-32B Q4)

ansible/roles/paperclip-docker/templates/certbot-init.sh.j2

@@ -0,0 +1,65 @@
+#!/bin/sh
+set -e
+
+DOMAIN="${PAPERCLIP_DOMAIN}"
+CERT_PATH="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
+EMAIL="${CERTBOT_EMAIL}"
+TOKEN="${CLOUDFLARE_API_TOKEN}"
+
+# Verify environment variables
+if [ -z "$DOMAIN" ]; then
+    echo "ERROR: PAPERCLIP_DOMAIN not set"
+    exit 1
+fi
+
+if [ -z "$EMAIL" ]; then
+    echo "ERROR: CERTBOT_EMAIL not set"
+    exit 1
+fi
+
+if [ -z "$TOKEN" ]; then
+    echo "ERROR: CLOUDFLARE_API_TOKEN not set"
+    exit 1
+fi
+
+# Check if certificate already exists
+if [ -f "$CERT_PATH" ]; then
+    echo "Certificate for $DOMAIN already exists at $CERT_PATH"
+    exit 0
+fi
+
+echo "Requesting certificate for $DOMAIN via Cloudflare DNS challenge..."
+
+# Create a temporary credentials file (more reliable than env var with certbot)
+CREDS_FILE="/tmp/cloudflare.ini"
+cat > "$CREDS_FILE" << EOF
+dns_cloudflare_api_token = ${TOKEN}
+EOF
+chmod 600 "$CREDS_FILE"
+
+# Request certificate with Cloudflare DNS plugin
+if certbot certonly \
+    --dns-cloudflare \
+    --dns-cloudflare-credentials "$CREDS_FILE" \
+    --agree-tos \
+    --no-eff-email \
+    --email "$EMAIL" \
+    --non-interactive \
+    -d "$DOMAIN"; then
+    echo "Certificate obtained successfully for $DOMAIN"
+else
+    echo "ERROR: Failed to obtain certificate for $DOMAIN"
+    rm -f "$CREDS_FILE"
+    exit 1
+fi
+
+# Clean up credentials file
+rm -f "$CREDS_FILE"
+
+# Verify certificate
+if [ -f "$CERT_PATH" ]; then
+    echo "Certificate verified at $CERT_PATH"
+else
+    echo "ERROR: Certificate not found at $CERT_PATH after successful certbot run"
+    exit 1
+fi