Document Ansible-built management cluster (plan step 4)

Phase-1 Step 2 rewritten around ansible/mgmt.yml and cluster-api-operator,
version pins for operator/cert-manager/cloud image, decisions #12-14,
execution log and changelog. Phase-1 Step 2 checked off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -5,7 +5,8 @@ Node autoscaling for Kubernetes clusters running as VMs on a home-lab hypervisor
 growing, in later phases, into a "poor man's Kubernetes-as-a-Service".
 
 > Status: **Phase 1 in progress** — VM template built and smoke-tested; management cluster
-> and first workload cluster next. Versions verified 2026-09-24/26, see [docs/versions.md](docs/versions.md).
+> running (k3s + CAPI via cluster-api-operator, built by [ansible/mgmt.yml](ansible/mgmt.yml));
+> first workload cluster `lab1` next. Versions verified 2026-09-24/26/27, see [docs/versions.md](docs/versions.md).
 
 ## Goals
 
@@ -74,6 +75,7 @@ Phases 2 and 3 are independent and can be done in either order.
 ├── README.md                     # this file
 ├── CLAUDE.md                     # context + rules for Claude Code sessions
 ├── CHANGELOG.md                  # milestones and significant changes, newest first
+├── ansible/                      # mgmt.yml: management VM + k3s + cert-manager + CAPI operator/providers
 ├── .claude/
 │   ├── agents/                   # upstream-researcher, cluster-inspector (read-only)
 │   ├── commands/                 # /ship
@@ -113,3 +115,5 @@ Short summary; the full log with alternatives and status is [docs/decisions.md](
    to keep its version under our control.
 5. **Scale-from-zero via capacity annotations** on the MachineDeployment — CAPMOX does not publish
    `status.capacity` on `ProxmoxMachineTemplate`.
+6. **Management cluster from one idempotent Ansible playbook**, CAPI providers installed by
+   **cluster-api-operator** instead of `clusterctl init` — re-runs are no-ops, upgrades are version bumps.