Use a Route53-only IAM user for DNS changes

dns.yml no longer depends on an expiring 'aws login' session. The
ansible_dns user's keys are in vault_aws_dns and can only edit the
thesatelliteoflove.com and nerder.land zones. Also adds the id record.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dns.yml

@@ -4,6 +4,12 @@
   hosts: localhost
   gather_facts: false
 
+  # Scoped IAM user (Route53 only) so this doesn't depend on an `aws login` session
+  module_defaults:
+    amazon.aws.route53:
+      access_key: "{{ vault_aws_dns.access_key }}"
+      secret_key: "{{ vault_aws_dns.secret_key }}"
+  
   vars:
     # Domains to manage DNS records for
     domains:
@@ -47,6 +53,8 @@
             ip: "{{ network.netcup_ip }}"
           - name: gokapi
             ip: "{{ network.netcup_ip }}"
+          - name: id
+            ip: "{{ network.netcup_ip }}"
       - name: nerder.land
         dns_records:
           - name: "forms"