fix: odstranit firewall roli + pridat btop, mc, tree do base packages

Firewall (UFW) neni pozadovan:
- smazana cela role roles/firewall/
- odstraneny reference z prepare-new-server.yml
- pridana poznamka v group_vars/all.yml.example
- doporuceni: firewall resit externe (Cloudflare Tunnel, security group)

Base packages - pridany chybejici utility:
+ btop (system monitor - lepsi nez htop)
+ mc  (Midnight Commander - textovy file manager)
+ tree (struktura adresaru v terminalu)
Ponechany: curl, wget, git, vim, htop, ca-certificates, gnupg,
          lsb-release, apt-transport-https, bash-completion,
          software-properties-common, unzip, zip, rsync, net-tools

playbooks/prepare-new-server.yml

@@ -8,9 +8,11 @@
 # 4. Adresarova struktura (/home/deploy/docker, ...)
 # 5. Docker Engine + Compose plugin
 # 6. Deploy user v docker group (docker bez sudo)
-# 7. UFW firewall (povoleno SSH, HTTP, HTTPS)
-# 8. fail2ban
+# 7. fail2ban
 #
+# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele
+# neni firewalled nasazen potreba. Pro produkcni nasazeni doporucujeme
+# nastavit firewall externe (Cloudflare Tunnel, security group na VPS, ...).
 # Pouziti:
 #   # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
 #   # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
@@ -45,7 +47,7 @@
           - nahraje SSH klice
           - nainstaluje Docker + Compose
           - vytvori adresarovou strukturu
-          - nastavi firewall
+          - nainstaluje fail2ban
 
           SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
           Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
@@ -61,8 +63,6 @@
       tags: [user, deploy]
     - role: ssh-keys
       tags: [ssh, keys]
-    - role: firewall
-      tags: [firewall, ufw]
     - role: docker
       tags: [docker]
     - role: directories