feat(rustdesk): onboard self-hosted RustDesk server on hk2

Deploy hbbs + hbbr via a safe-by-default Ansible role (playbooks/rustdesk.yml):
with rustdesk_confirm=false it only reports whether compose.yml matches live
state and refuses to recreate the stack; with rustdesk_confirm=true it deploys
and recreates. The relay assert rejects the known-bad hk2.wsvc.info hostname.

Add health profiles rustdesk (hbbs/hbbr health, relay DNS) and hk2aux (co-located
traefik/adguard/remark42 on hk2), plus the rustdesk-health runbook and AGENTS.md
entry. Server image pinned rustdesk/rustdesk-server:1.1.14.

ansible/roles/healthcheck/templates/rustdesk.sh.j2

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -uo pipefail
+source '{{ healthcheck_install_root }}/health-common.sh'
+
+require_command docker
+require_command dig
+
+# hbbs / hbbr must both be running (separate compose project at /opt/rustdesk).
+output="$(docker compose --project-directory /opt/rustdesk ps --all 2>&1)"
+if grep -qiE 'Exited|Restarting|[[:space:]]Dead[[:space:]]' <<<"$output"; then
+  record critical 'rustdesk_unhealthy_container'
+else
+  record ok 'rustdesk_compose_ok'
+fi
+
+# hbbs must advertise the relay hostname that resolves to this host's public IP.
+cmd="$(docker inspect hbbs --format '{{ '{{' }}json .Config.Cmd{{ '}}' }}' 2>/dev/null)" || record critical 'rustdesk_hbbs_missing'
+grep -q 'hk2.chans.xyz:21117' <<<"$cmd" || record critical 'rustdesk_relay_misconfigured'
+
+# The advertised relay hostname must resolve to this host's public IP.
+resolved="$(dig +short hk2.chans.xyz A 2>/dev/null)"
+grep -q '154.36.174.161' <<<"$resolved" || record critical 'rustdesk_relay_dns_missing'
+
+emit_result
+exit "$EXIT_CODE"