Turn off SSH password and root login

sshd accepted passwords from the internet (about 12,000 failed logins a
day) and root logins with a key. Keys only now, no root, no X11 forwarding.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/common/README.md

@@ -6,6 +6,8 @@ Base setup applied first by `site.yml` (tag `common`).
 - Installs `aptitude` and `jq`.
 - Installs `unattended-upgrades` and turns on daily security updates
   (Debian security archive only, no automatic reboots).
+- SSH: keys only, no root login, no X11 forwarding
+  (`/etc/ssh/sshd_config.d/10-hardening.conf`, reloads ssh when changed).
 - Makes sure UFW is enabled with default deny. The SSH rule comes from the
   bootstrap role, and container rules from `ufw-docker` in the docker role.