Add repository scaffolding

MIT license, the ignore list that keeps secrets and Ansible scratch files
out, and a .gitattributes that normalises everything to LF — payloads are
deployed to Linux hosts, where a CRLF breaks a shell script outright.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

.gitignore

@@ -0,0 +1,32 @@
+# Secrets never belong in this repository. See docs/secrets.md.
+.env
+.env.local
+.env.*.local
+.vault_pass
+vault-password*
+*.vault
+*.pem
+id_rsa*
+id_ed25519*
+
+# Ansible
+*.retry
+ansible/collections/
+ansible/inventory/host_vars/*.local.yml
+# Scratch directory ansible-lint and ansible-core create in the working directory
+.ansible/
+
+# Editors and OS
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+
+# Python, for the linting toolchain
+__pycache__/
+*.pyc
+.venv/
+
+# Claude Code — settings.json is shared, settings.local.json is personal
+.claude/settings.local.json