docs: onboard AdGuard Home to Ansible; retire check-mx2; migrate plan to Linear

- Add dns.windy.lan to Ansible inventory (adguardhome group/profile) with a
  read-only healthcheck template, systemd timer, and on-demand report parity
  with the other active hosts; verified green on the host.
- Add synapse.chans.xyz to the AGENTS.md active-host quick map.
- Remove plans/; migrate decisions/verification to a Linear vps project doc and
  file the remaining gaps as W1N-46..49 with blocking edges.
- Retire scripts/check-mx2.sh; point mailcow health/update runbooks and the
  mx2 host file at the Ansible health report.
- Trim us2 stub software to verified running services; note dormant dirs.
- Normalize repo docs to English; drop the non-existent CONTEXT.md/ADR claim
  and remove docs/agents/domain.md.

ansible/inventory/hosts.yml

@@ -56,6 +56,15 @@ all:
           service_reconcile_services:
             wireguard:
               compose_args: [--no-deps, --force-recreate]
+        dns_windy_lan:
+          ansible_host: 192.168.66.36
+          ansible_host_ipv4: 192.168.66.36
+          service_role: adguardhome
+          compose_project_dir: /opt/adguardhome
+          healthcheck_profile: adguardhome
+          service_reconcile_services:
+            adguardhome:
+              compose_args: [--no-deps, --force-recreate]
     mailcow:
       hosts:
         mx2:
@@ -68,12 +77,16 @@ all:
     wireguard:
       hosts:
         us4:
+    adguardhome:
+      hosts:
+        dns_windy_lan:
     docker_hosts:
       children:
         mailcow:
         vaultwarden:
         powerdns:
         wireguard:
+        adguardhome:
     # Matrix is a dedicated K3s node and intentionally remains outside the
     # Docker-oriented managed group.
     k3s_servers:

ansible/roles/healthcheck/defaults/main.yml

@@ -12,3 +12,4 @@ healthcheck_profiles:
   vaultwarden: vaultwarden.sh
   pdns: pdns.sh
   wireguard: wireguard.sh
+  adguardhome: adguardhome.sh

ansible/roles/healthcheck/templates/adguardhome.sh.j2

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -uo pipefail
+source '{{ healthcheck_install_root }}/health-common.sh'
+
+require_command docker
+require_command curl
+require_command dig
+require_command ss
+require_command df
+check_compose
+
+container='adguardhome'
+if ! docker inspect "$container" >/dev/null 2>&1; then
+  record critical 'adguardhome_container_missing'
+else
+  running="$(docker inspect "$container" --format '{{ '{{' }}.State.Running{{ '}}' }}' 2>/dev/null)"
+  [[ "$running" == true ]] || record critical 'adguardhome_container_not_running'
+fi
+
+config_check="$(docker exec "$container" /opt/adguardhome/AdGuardHome --check-config \
+  -c /opt/adguardhome/conf/AdGuardHome.yaml 2>&1 || true)"
+if grep -qiE 'error|invalid|fatal' <<<"$config_check"; then
+  record critical 'adguardhome_config_invalid'
+else
+  record ok 'adguardhome_config_valid'
+fi
+
+if ss -H -ltn 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)53$'; then
+  record ok 'dns_tcp_53_listening'
+else
+  record critical 'dns_tcp_53_missing'
+fi
+if ss -H -uln 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)53$'; then
+  record ok 'dns_udp_53_listening'
+else
+  record critical 'dns_udp_53_missing'
+fi
+if ss -H -ltn 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)80$'; then
+  record ok 'ui_http_80_listening'
+else
+  record critical 'ui_http_80_missing'
+fi
+
+dns_a="$(dig +time=5 +tries=1 @192.168.66.36 example.com A +noall +answer 2>/dev/null)"
+[[ -n "$dns_a" ]] && record ok 'dns_example_a' || record critical 'dns_example_a_failed'
+dns_aaaa="$(dig +time=5 +tries=1 @192.168.66.36 example.com AAAA +noall +answer 2>/dev/null)"
+[[ -n "$dns_aaaa" ]] && record ok 'dns_example_aaaa' || record warning 'dns_example_aaaa_none'
+dns_local="$(dig +time=5 +tries=1 @192.168.66.36 hass.windy.lan A +noall +answer 2>/dev/null)"
+[[ -n "$dns_local" ]] && record ok 'dns_local_name' || record warning 'dns_local_name_unresolved'
+
+ui_code="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' --max-time 10 http://192.168.66.36/ 2>/dev/null || true)"
+case "$ui_code" in
+  200|301|302) record ok "ui_http_${ui_code}" ;;
+  '') record critical 'ui_unreachable' ;;
+  *) record critical "ui_http_${ui_code}" ;;
+esac
+
+usage="$(df -P /opt/adguardhome/work 2>/dev/null | awk 'NR==2 {print $5}' | tr -d '%')"
+if [[ "$usage" =~ ^[0-9]+$ ]]; then
+  if (( usage >= 90 )); then record critical 'disk_usage_high'
+  elif (( usage >= 80 )); then record warning 'disk_usage_elevated'
+  else record ok 'disk_usage_ok'; fi
+else
+  record unknown 'disk_usage_unknown'
+fi
+
+logs="$(docker logs --since 30m "$container" 2>&1 || true)"
+if grep -qiE '\[(error|warn|fatal)\]|level=(error|warn|fatal)' <<<"$logs"; then
+  record warning 'adguardhome_log_errors'
+else
+  record ok 'adguardhome_logs_clean'
+fi
+
+emit_result
+exit "$EXIT_CODE"