Clean up inventory, group_vars, and prefill READMEs

- hosts.ini: underscore group names, hostname aliases with ansible_host
- move ansible_user/ansible_port to group_vars/all.yml
- rename group_vars files to match underscore group names
- trim sftp group_vars to its only override (password auth off)
- run.yml: load moved secrets file (group_vars/secrets.yml)
- untrack .DS_Store, extend .gitignore
- prefill root/ansible/server READMEs, add jira + cloud server folders
- update CLAUDE.md to match

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -17,15 +17,17 @@ Infrastructure as Code and runbooks for Phytron's server infrastructure. Global
 
 ```
 ansible/                    # Global settings & configuration for all servers
-  hosts.ini                 # Inventory: all existing and planned servers with IPs
-                            # (one group per host, group name == hostname)
-  group_vars/all.yml        # Defaults shared by all hosts
-  group_vars/<hostname>.yml # Per-host variables
+  hosts.ini                 # Inventory: all existing and planned servers with IPs.
+                            # One group per host; group names use underscores
+                            # (phy_z_srv_git), host aliases the real hostnames
+                            # (phy-z-srv-git ansible_host=<IP>)
+  group_vars/all.yml        # Defaults shared by all hosts (incl. ansible_user/port)
+  group_vars/<group>.yml    # Per-host overrides ONLY — no copies of all.yml values
+  group_vars/secrets.yml    # ansible-vault encrypted secrets — never commit plaintext
   run.yml                   # Main playbook
   playbooks/                # Utility playbooks (update.yml, shutdown.yml)
   roles/                    # Custom roles (e.g. nextcloud)
   requirements.yml          # External Galaxy roles (geerlingguy.*, ...)
-  vars/vault.yml            # ansible-vault encrypted secrets — never commit plaintext
   justfile                  # Task runner: just run HOST, just reqs, just vault ACTION
 
 server/<hostname>/          # Host-specific docs, scripts, files
@@ -47,6 +49,7 @@ server/<hostname>/          # Host-specific docs, scripts, files
 ## Conventions
 
 - Ansible commands run from `ansible/`, preferably via the `justfile` (e.g. `just run <HOST>`).
-- Secrets go into `ansible/vars/vault.yml`, encrypted with ansible-vault. Never commit plaintext secrets.
+- Secrets go into `ansible/group_vars/secrets.yml`, encrypted with ansible-vault. Never commit plaintext secrets.
+- SSH password authentication stays enabled for easy access (servers are not reachable from outside); exception: DMZ hosts like phy-z-dmz-sftp01 are key-only.
 - Dated documents (runbooks, assessments) use the `YYYYMMDD-<topic>.md` naming scheme.
-- New servers get: an entry in `hosts.ini`, a `group_vars/<hostname>.yml`, and a `server/<hostname>/` folder with a README.
+- New servers get: an entry in `hosts.ini`, a `group_vars/<group>.yml` (overrides only), and a `server/<hostname>/` folder with a README.