add projects/ - standalone scripts alongside the Docker stacks

Two real, working scripts: an Ansible playbook run-menu (the same
pattern used identically across both the fleet-config and infra-
provisioning repos), and cuesplit, a frame-accurate FLAC/.cue
splitting utility. Sanitized paths only, logic untouched.

README gets a new "Scripts & Tooling" section pointing at it, placed
right after "What's Running" alongside the other repo-structure
pointer.

projects/ansible-run-menu/run

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -e
+
+PLAYBOOK="$1"
+shift || true   # capture any extra ansible-playbook flags (--check, --limit, -vv, etc.)
+
+if [ -z "$PLAYBOOK" ]; then
+  echo "Usage: run <playbook> [extra ansible-playbook args]"
+  echo ""
+  echo "Available playbooks:"
+  echo "  os_update_vms"
+  echo "  os_update_pve"
+  echo "  os_update_pve_verify"
+  echo "  os_update_pbs"
+  echo "  container_update"
+  echo "  app_update"
+  echo "  disk_cleanup"
+  echo "  automation_self_update"
+  echo "  dashy_fleet_audit"
+  echo "  dashy_selfhosting_coverage"
+  echo "  emby_tag_sync"
+  echo "  jellyfin_tag_sync"
+  echo ""
+  echo "Examples:"
+  echo "  run os_update_vms"
+  echo "  run os_update_vms --check --limit caddy -vv"
+  exit 1
+fi
+
+ANSIBLE_DIR="/path/to/ansible"
+VENV="$HOME/ansible-modern"
+SSH_KEY="$HOME/.ssh/auto"
+VAULT_FILE="$ANSIBLE_DIR/.vault_pass.txt"
+INVENTORY="$ANSIBLE_DIR/inventory.yml"
+
+case "$PLAYBOOK" in
+  os_update_vms|os_update_pve|os_update_pve_verify|os_update_pbs|container_update|app_update|disk_cleanup|automation_self_update|dashy_fleet_audit|dashy_selfhosting_coverage|emby_tag_sync|jellyfin_tag_sync)
+    ;;
+  *)
+    echo "Unknown playbook: $PLAYBOOK"
+    exit 1
+    ;;
+esac
+
+cd "$ANSIBLE_DIR"
+
+VAULT_ARGS=()
+if [ -f "$VAULT_FILE" ]; then
+  VAULT_ARGS=(--vault-password-file "$VAULT_FILE")
+fi
+
+exec "$VENV/bin/ansible-playbook" \
+  -i "$INVENTORY" \
+  "playbooks/${PLAYBOOK}.yml" \
+  "${VAULT_ARGS[@]}" \
+  "$@"