Clean up inventory, group_vars, and prefill READMEs

- hosts.ini: underscore group names, hostname aliases with ansible_host
- move ansible_user/ansible_port to group_vars/all.yml
- rename group_vars files to match underscore group names
- trim sftp group_vars to its only override (password auth off)
- run.yml: load moved secrets file (group_vars/secrets.yml)
- untrack .DS_Store, extend .gitignore
- prefill root/ansible/server READMEs, add jira + cloud server folders
- update CLAUDE.md to match

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ansible/README.md

@@ -1,3 +1,20 @@
-# Buero Templates for used software deployments
+# Ansible
 
-In this repository I collect all ansible playbooks used during my work.
+Global configuration for all Phytron servers. Run everything from this directory, preferably via `just`.
+
+## Layout
+
+- `hosts.ini` — inventory; one group per host (`phy_z_*`), host aliases match the real hostnames
+- `group_vars/all.yml` — defaults for all hosts; `group_vars/<group>.yml` holds per-host overrides only
+- `group_vars/secrets.yml` — ansible-vault encrypted secrets
+- `run.yml` — main playbook; `playbooks/` — utilities (update, shutdown)
+- `roles/` — custom roles; external roles come from `requirements.yml`
+
+## Usage
+
+```sh
+just reqs                     # install Galaxy role requirements
+just run <HOST> [ARGS]       # run run.yml against one host, e.g. just run phy_z_srv_cloud
+just compose <HOST>          # docker compose tasks only (--tags compose)
+just vault edit              # edit encrypted secrets (encrypt/decrypt/edit)
+```