Add the compose_stack role, inventory and playbooks

One role that syncs a payload and brings the stack up, configured entirely
through stack_* variables, plus six playbooks that each demonstrate one part
of that contract. Every playbook runs standalone and is tagged with its
stack name, so site.yml --tags <stack> works.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ansible/roles/compose_stack/defaults/main.yml

@@ -0,0 +1,53 @@
+---
+# The variable contract. Playbooks set these; nothing else should. Every entry is
+# documented in AGENTS.md — keep the two in step.
+
+# Required. Names the stack, and by default its payload and destination too.
+stack_name: ""
+
+# Payload directory in this repository, and where it lands on the host. Override
+# stack_src to share one payload between hosts or between two instances of the
+# same application; override stack_dest when the remote directory cannot be
+# named after the stack.
+stack_src: "{{ repo_root }}/server/{{ inventory_hostname }}/{{ stack_name }}"
+stack_dest: "{{ stack_root | default('/srv/stacks') }}/{{ stack_name }}"
+
+# Extra directories to create before the stack starts. Each entry needs a `path`;
+# `mode`, `owner`, `group` and `recurse` are optional and applied only when
+# given, so a directory that already exists on the host is never re-chmodded or
+# re-chowned.
+stack_dirs: []
+
+# Extra environment for the compose invocation. PWD is always set to stack_dest;
+# anything here is merged on top.
+stack_env: {}
+
+# External Docker networks the compose file expects to already exist.
+stack_networks: []
+
+# Compose files, relative to stack_dest, in the order `docker compose -f` wants.
+stack_files:
+  - docker-compose.yml
+
+# Never ship secrets to the host through the payload. Extend this list; do not
+# replace it without understanding what you are letting through.
+stack_exclude:
+  - .env
+
+# Whether the sync removes host files that are no longer in the payload. Off by
+# default: a stack's directory usually also holds data the payload knows nothing
+# about (bind mounts, certificates, logs).
+stack_prune: false
+
+# present, absent, or restarted.
+stack_state: present
+
+# Image pull policy for this invocation. Defaults to the repo-wide `pull` flag so
+# `-e pull=always` keeps working, but because it is a role variable a playbook
+# can override it for a single call — for example to sync with the old images,
+# run a database upgrade, and only then bring the stack up on the new ones.
+stack_pull: "{{ pull | default('policy') }}"
+
+# Compose build policy. `policy` builds only when the image is missing; stacks
+# that build from a Dockerfile in their payload want `always` on an update run.
+stack_build: policy