feat: add gated Compose deploy and make inventory the host source of truth

Keep sanitized Compose sources in-repo with a confirmation-gated Ansible
playbook, add repo-wide validation, tighten runbook ownership/STOP/review
metadata, and archive stale research docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

runbooks/vaultwarden-sqlite-to-postgres.md

@@ -9,6 +9,12 @@ Replay checklist for the exceptional SQLite→Postgres migration on us2.
 - Applicable: [us2.wsvc.info](../hosts/us2.wsvc.info.md), `/opt/vaultwarden`.
 - Not applicable: routine reconcile — this is destructive and intentionally not automated.
 
+## Ownership
+
+- Owner: personal ops (Windy)
+- Last reviewed: 2026-08-17
+- Related systems: us2.wsvc.info (`/opt/vaultwarden`)
+
 ## Safety
 
 - Destructive: requires explicit approval; confirm backups exist before starting.