Add base plays for all hosts, nvidia_gpu role, GPU pre-work items

- run.yml: base plays (geerlingguy.security) for jira and git; gpu01
  play with security + docker + nvidia_gpu
- roles/nvidia_gpu: driver pinned >=580 (Blackwell), CUDA repo,
  container toolkit incl. the nvidia-ctk runtime configure step
- manuals/20260714-nvidia-driver-install.md: dated per convention,
  corrected (pinned -server driver instead of autoinstall+cuda-drivers
  mix, toolkit optional, added missing nvidia-ctk/docker restart step)
- gpu01 folder: planning docs under notes/, runbooks under manuals/,
  scripts/; convention documented in CLAUDE.md
- scripts/share-analysis.ps1: read-only SMB share analysis for the
  Windows server (projektplan §2.1)
- TODO.md: Phase-0 pre-work items from the projektplan

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ansible/run.yml

@@ -33,3 +33,58 @@
   roles:
     - role: geerlingguy.security
       tags: base
+
+
+- hosts: phy_z_srv_jira
+  become: yes
+  vars_files:
+    - "group_vars/secrets.yml"
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt:
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - role: geerlingguy.security
+      tags: base
+
+
+- hosts: phy_z_srv_git
+  become: yes
+  vars_files:
+    - "group_vars/secrets.yml"
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt:
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - role: geerlingguy.security
+      tags: base
+
+
+- hosts: phy_z_srv_gpu01
+  become: yes
+  vars_files:
+    - "group_vars/secrets.yml"
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt:
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - role: geerlingguy.security
+      tags: base
+    - role: geerlingguy.docker
+      tags: docker
+    - role: nvidia_gpu
+      tags: gpu