Add Ansible playbook for the management cluster (step 1)

VM from Ubuntu cloud image on pv1-1, pinned k3s, cert-manager and
cluster-api-operator via k3s HelmChart CRs, CAPI providers as operator CRs,
kubeconfig fetch + cluster-inspector kubeconfig. Lint passes (production).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/templates/capi-providers.yaml.j2

@@ -0,0 +1,33 @@
+{% for p in capi_providers %}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ p.namespace }}
+---
+{% endfor %}
+# Read by CAPMOX v0.9.1 components; the operator does not watch it, so rotating the token
+# means a new Secret name + updated configSecret reference.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: capmox-variables
+  namespace: capmox-system
+type: Opaque
+stringData:
+  PROXMOX_URL: "{{ proxmox_url }}"
+  PROXMOX_TOKEN: "{{ proxmox_token_id }}"
+  PROXMOX_SECRET: "{{ proxmox_token_secret }}"
+{% for p in capi_providers %}
+---
+apiVersion: operator.cluster.x-k8s.io/v1alpha2
+kind: {{ p.kind }}
+metadata:
+  name: {{ p.name }}
+  namespace: {{ p.namespace }}
+spec:
+  version: {{ p.version }}
+{% if p.config_secret is defined %}
+  configSecret:
+    name: {{ p.config_secret }}
+{% endif %}
+{% endfor %}

ansible/templates/helmchart-capi-operator.yaml.j2

@@ -0,0 +1,13 @@
+# Providers are NOT set in chart values (they would become Helm hooks, cluster-api-operator#1052);
+# they are applied as separate CRs from capi-providers.yaml.
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cluster-api-operator
+  namespace: kube-system
+spec:
+  repo: https://kubernetes-sigs.github.io/cluster-api-operator
+  chart: cluster-api-operator
+  version: {{ capi_operator_chart_version }}
+  targetNamespace: capi-operator-system
+  createNamespace: true

ansible/templates/helmchart-cert-manager.yaml.j2

@@ -0,0 +1,14 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager
+  namespace: kube-system
+spec:
+  repo: https://charts.jetstack.io
+  chart: cert-manager
+  version: {{ cert_manager_chart_version }}
+  targetNamespace: cert-manager
+  createNamespace: true
+  valuesContent: |-
+    crds:
+      enabled: true

ansible/templates/k3s-config.yaml.j2

@@ -0,0 +1,5 @@
+write-kubeconfig-mode: "0600"
+tls-san:
+  - {{ mgmt_ip }}
+disable:
+  - traefik