Add repo foundation: proxmox/lxc/vms groups, ansible.cfg, collections, lint configs

- inventory: add proxmox host, lxc and vms groups, critical_services per host
- retarget bootstrap and time-region to ubuntu:rocky so the Proxmox host is untouched
- add ansible.cfg, collections/requirements.yml, .gitignore, .yamllint, .ansible-lint
- remove stale root new_lxc.yml duplicate and the Nextcloud upgrade playbook

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JEczyvRjfakkiDNkbZA7PR

playbooks/bootstrap_lxc.yml

@@ -1,3 +1,4 @@
+---
 - name: Bootstrap - Install packages on Ubuntu
   hosts: ubuntu
   become: true
@@ -78,7 +79,7 @@
         update_cache: true
 
 - name: Bootstrap - Configure SSH access
-  hosts: all
+  hosts: ubuntu:rocky
   become: true
 
   tasks:
@@ -114,6 +115,7 @@
         line: 'PubkeyAuthentication yes'
         state: present
 
+    # NOTE: playbooks/ssh_harden.yml overrides this via /etc/ssh/sshd_config.d/00-ansible.conf
     - name: Ensure PasswordAuthentication is enabled
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config