feat(rustdesk): onboard self-hosted RustDesk server on hk2

Deploy hbbs + hbbr via a safe-by-default Ansible role (playbooks/rustdesk.yml):
with rustdesk_confirm=false it only reports whether compose.yml matches live
state and refuses to recreate the stack; with rustdesk_confirm=true it deploys
and recreates. The relay assert rejects the known-bad hk2.wsvc.info hostname.

Add health profiles rustdesk (hbbs/hbbr health, relay DNS) and hk2aux (co-located
traefik/adguard/remark42 on hk2), plus the rustdesk-health runbook and AGENTS.md
entry. Server image pinned rustdesk/rustdesk-server:1.1.14.

ansible/playbooks/rustdesk.yml

@@ -0,0 +1,20 @@
+---
+# Deploy/reconcile the self-hosted RustDesk server (hbbs + hbbr) on hk2.
+#
+# Safe by default: run with --check for a read-only report, or supply
+# rustdesk_confirm=true to deploy the compose file and recreate the stack.
+#
+#   # Read-only report
+#   ansible-playbook playbooks/rustdesk.yml --limit rustdesk --check
+#
+#   # Apply (deploy compose + recreate hbbs/hbbr)
+#   ansible-playbook playbooks/rustdesk.yml --limit rustdesk \
+#     -e '{"rustdesk_confirm": true}'
+- name: Deploy and reconcile RustDesk server
+  hosts: rustdesk
+  become: true
+  gather_facts: false
+  serial: 1
+  roles:
+    - role: rustdesk
+      tags: [rustdesk, mutating]