Add the compose_stack role, inventory and playbooks

One role that syncs a payload and brings the stack up, configured entirely
through stack_* variables, plus six playbooks that each demonstrate one part
of that contract. Every playbook runs standalone and is tagged with its
stack name, so site.yml --tags <stack> works.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ansible/playbooks/webapp-staging.yml

@@ -0,0 +1,35 @@
+---
+# A second instance of webapp, from the same payload.
+#
+# Demonstrates stack_src, stack_dest and stack_env together: one set of compose
+# files, deployed twice to the same host under different directories with
+# different settings. This is much better than a forked copy of the payload,
+# which drifts the first time someone fixes a bug in only one of them.
+#
+# Staging deliberately has no backup-and-migrate phase. It is rebuilt from the
+# same images and its data is disposable, so the whole two-phase apparatus in
+# webapp.yml would be ceremony here.
+- name: Deploy webapp staging
+  hosts: app
+  gather_facts: false
+  tags: [webapp-staging]
+
+  roles:
+    - role: compose_stack
+      vars:
+        stack_name: webapp-staging
+        # The same payload as the production instance.
+        stack_src: "{{ repo_root }}/server/app/webapp"
+        # ...deployed somewhere else. Without this, stack_dest would default to
+        # {{ stack_root }}/webapp-staging, which happens to be right here, but
+        # spelling it out is what makes the pairing with stack_src obvious.
+        stack_dest: "{{ stack_root }}/webapp-staging"
+        stack_networks:
+          - proxy-net
+        stack_files:
+          - docker-compose.yml
+        # Per-instance settings, merged into the compose environment on top of
+        # PWD. The compose file reads these; nothing in the payload knows which
+        # instance it is.
+        stack_env:
+          COMPOSE_PROJECT_NAME: webapp-staging