Idempotent server setup
Goal: Make server provisioning repeatable and safe to run multiple times.
- Define an inventory and host groups.
- Start with one play that installs packages and configures a service.
- Run with `--check --diff` first, then real run.
- Refactor into roles and tag your tasks.
- Add CI linting and run against staging before prod.