Pr/cloudops assignment

[Bluelotuss]

This PR adds:

• host provisioning with Ansible roles
• Docker Compose-based app/postgres/redis stack
• Nginx reverse proxy with HTTPS and local-only stub_status
• deploy user, sshd hardening, firewall, journald, backup, and systemd reload
• deploy playbook and GitHub Actions workflow scaffold

Notes:

• some future-oriented paths remain documented as comments, such as git-based app delivery and real S3 production wiring