Clean up inventory, group_vars, and prefill READMEs

- hosts.ini: underscore group names, hostname aliases with ansible_host
- move ansible_user/ansible_port to group_vars/all.yml
- rename group_vars files to match underscore group names
- trim sftp group_vars to its only override (password auth off)
- run.yml: load moved secrets file (group_vars/secrets.yml)
- untrack .DS_Store, extend .gitignore
- prefill root/ansible/server READMEs, add jira + cloud server folders
- update CLAUDE.md to match

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ansible/run.yml

@@ -1,25 +1,8 @@
 ---
-#- hosts: owncloud
-#  become: yes
-#  vars_files:
-#    - "vars/vault.yml"
-#
-#  pre_tasks:
-#    - name: Update apt cache.
-#      apt:
-#        update_cache: true
-#        cache_valid_time: 3600
-#      when: ansible_os_family == 'Debian'
-#
-#  roles:
-#    - role: geerlingguy.security
-#    #- role: geerlingguy.ntp ## NEEDED?
-#    - role: owncloud
-
-- hosts: nextcloud
+- hosts: phy_z_srv_cloud
   become: yes
   vars_files:
-    - "vars/vault.yml"
+    - "group_vars/secrets.yml"
 
   pre_tasks:
     - name: Update apt cache.
@@ -35,10 +18,10 @@
       tags: mail
 
 
-- hosts: sftp
+- hosts: phy_z_dmz_sftp01
   become: yes
   vars_files:
-    - "vars/vault.yml"
+    - "group_vars/secrets.yml"
 
   pre_tasks:
     - name: Update apt cache.