Restructure into one folder per private repo/host, not a flat Docker/ dump

rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.

Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.

automation/iac/old-content/Ansible/roles_metadata.yml

@@ -0,0 +1,123 @@
+roles_metadata:
+  # Bootstrap roles
+  base_users:
+    initialization: true
+    provisioning: false
+    compliance: false
+    description: "Base user creation tasks"
+
+  disk_resize:
+    initialization: true
+    provisioning: false
+    compliance: true
+    description: "Disk resizing tasks"
+
+  docker_gitlab_setup:
+    initialization: true
+    provisioning: false
+    compliance: false
+    description: "Docker runtime files moving and homelab repo copy"
+
+  endlessh:
+    initialization: true
+    provisioning: false
+    compliance: false
+    description: "Endlessh setup"
+
+  firewall_ssh:
+    initialization: true
+    provisioning: false
+    compliance: true
+    description: "Firewall and SSH configuration"
+
+  hostname_network:
+    initialization: true
+    provisioning: false
+    compliance: false
+    description: "Set hostname and networking"
+
+  packages:
+    initialization: true
+    provisioning: false
+    compliance: true
+    description: "base packages and update tasks"
+
+  portainer_agent:
+    initialization: true
+    provisioning: false
+    compliance: true
+    description: "Portainer agent setup"
+
+  root_password:
+    initialization: true
+    provisioning: false
+    compliance: false
+    description: "Root password setup"
+
+  zsh_custom:
+    initialization: true
+    provisioning: false
+    compliance: false
+    description: "Custom Zsh setup"
+
+  # CIS Hardening roles
+  banners:
+    initialization: false
+    provisioning: false
+    compliance: true
+    description: "Login banners setup"
+
+  file_permissions:
+    initialization: false
+    provisioning: false
+    compliance: true
+    description: "File permissions hardening"
+
+  filesystem_hardening:
+    initialization: false
+    provisioning: false
+    compliance: true
+    description: "filesystems hardening"
+
+  kernel_hardening:
+    initialization: false
+    provisioning: false
+    compliance: true
+    description: "Kernel hardening tasks"
+
+  password_policy:
+    initialization: false
+    provisioning: false
+    compliance: true
+    description: "Password policy enforcement"
+
+  service_disable:
+    initialization: false
+    provisioning: false
+    compliance: true
+    description: "Disable unnecessary services"
+
+  ssh_hardening:
+    initialization: false
+    provisioning: false
+    compliance: true
+    description: "SSH hardening"
+
+  # SecureVault roles
+  haproxy:
+    initialization: false
+    provisioning: true
+    compliance: true
+    description: "haproxy deployment"
+
+  vault_agent:
+    initialization: true
+    provisioning: false
+    compliance: false
+    description: "vault_agent deployment"
+
+  technitium:
+    initialization: false
+    provisioning: true
+    compliance: false
+    description: "technitium deployment"