Clean up inventory, group_vars, and prefill READMEs

- hosts.ini: underscore group names, hostname aliases with ansible_host
- move ansible_user/ansible_port to group_vars/all.yml
- rename group_vars files to match underscore group names
- trim sftp group_vars to its only override (password auth off)
- run.yml: load moved secrets file (group_vars/secrets.yml)
- untrack .DS_Store, extend .gitignore
- prefill root/ansible/server READMEs, add jira + cloud server folders
- update CLAUDE.md to match

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/phy-z-dmz-sftp01/README.md

@@ -0,0 +1,18 @@
+# phy-z-dmz-sftp01
+
+SFTP server in the DMZ for file exchange with external partners.
+
+| | |
+| - | - |
+| IP | 192.168.66.68 |
+| Ansible group | `phy_z_dmz_sftp01` |
+| Status | configured |
+
+## Services
+
+- SFTP access for external users
+- SSH password authentication is disabled (key-only), see `ansible/group_vars/phy_z_dmz_sftp01.yml`
+
+## Runbooks
+
+- [Add a new SFTP user](manuals/20260204-add-new-user.md)