Bring the docs up to date with the running stack

The READMEs, CLAUDE.md and todo.md still described Authentik, services
removed long ago (Ghost, MMDL, Postiz, Pinchflat...) and two servers. Now
they list the 24 services actually deployed (checked against docker ps),
explain that netcup and docker-01 are one machine, document Gondulf,
StarPunk, Listmonk, Gokapi and dockcheck, and use bin/deploy throughout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/bootstrap/README.md

@@ -1,41 +1,29 @@
 # Bootstrap Role
 
-## Purpose
-Performs initial server setup and hardening for new Ubuntu/Debian servers.
+First-time setup for a fresh Debian/Ubuntu server. Run once, against the
+server's public IP (inventory group `bootstrap`, host `netcup`), before
+`site.yml` can reach it over Tailscale.
 
-## What It Does
+## What it does
+- Installs `aptitude`, `curl`, `vim`, `git` and `ufw`.
+- Gives the `sudo` group passwordless sudo.
+- Creates the user `created_username` (set to `phil` in `bootstrap.yml`) in
+  the `sudo` group, with your local `~/.ssh/id_ed25519.pub` as its SSH key.
+- Sets `PermitRootLogin prohibit-password` (root can still log in with a key).
+- UFW: allows OpenSSH, enables the firewall with default deny.
 
-### User Management
-- Creates a new user account with sudo privileges (specified by `created_username` variable)
-- Configures passwordless sudo for the sudo group
-- Sets up SSH key authentication using your local `~/.ssh/id_ed25519.pub` key
-- Disables root password authentication
+`bootstrap.yml` then runs the `artis3n.tailscale` role to join the tailnet,
+using `vault_infrastructure.tailscale_key` from the vault.
 
-### System Packages
-- Installs `aptitude` for better package management
-- Installs essential packages:
-  - `curl` - HTTP client
-  - `vim` - Text editor
-  - `git` - Version control
-  - `ufw` - Uncomplicated Firewall
-
-### Security Configuration
-- Configures UFW firewall to:
-  - Allow SSH connections
-  - Enable firewall with default deny policy
-- Hardens SSH configuration
-
-## Variables Required
-- `created_username`: The username to create (typically set in bootstrap.yml)
-- `tailscale_key`: Tailscale authentication key (prompted during playbook run)
-
-## Dependencies
-- Requires the `artis3n.tailscale` role for VPN setup
-- Requires your SSH public key at `~/.ssh/id_ed25519.pub`
+## Requirements
+- `ansible-galaxy install -r requirements.yml` (for `artis3n.tailscale`).
+- `~/.ssh/id_ed25519.pub` on the machine running Ansible.
+- Root (or another sudo user) SSH access to the new server.
 
 ## Usage
 ```bash
-ansible-playbook bootstrap.yml -i hosts.yml
+.venv/bin/ansible-playbook bootstrap.yml -i hosts.yml --vault-password-file vault_pass
 ```
 
-This role is designed to be run once on a fresh server before deploying other services.
+Once the server is on Tailscale, put its Tailscale IP in `hosts.yml` under
+`docker` and use `bin/deploy` from then on.