refactor: ceske nazvy playbooku a roli bez diakritiky

Playbooky (novy nazev -> co dela):
- priprav-novy-server.yml (kompletni setup noveho serveru)
- nasad-sluzby.yml (nasadi Docker sluzby z docker-services/)
- aktualizuj-sluzby.yml (docker compose pull && up -d)
- zabezpec-server.yml (sysctl, auditd, unattended-upgrades)
- bootstrap-server.yml SMAZAN (duplicitni s priprav-novy-server)

Role (novy nazev -> co dela):
- zaklad (update + base baliky + timezone)
- uzivatel-deploy (vytvori deploy usera UID 1000)
- ssh-klice (authorized_keys deployment)
- docker (Docker Engine + Compose plugin) - ponechan anglicky (IT konvence)
- adresare (/home/deploy/{docker,scripts,backups,logs,...})
- firewall SMAZAN (nepouziva se)

Reference v playbooku aktualizovany na nove nazvy roli.
README.md kompletne prepracovan v cestine pro zacatecniky - vysvetluje
co Ansible je, jak nainstalovat, jak vytvorit inventory, jak spustit
playbook, jak overit ze vse funguje.

playbooks/priprav-novy-server.yml

@@ -0,0 +1,126 @@
+---
+# Playbook: priprav-novy-server.yml
+#
+# Kompletni priprava noveho Ubuntu serveru (od nuly):
+# 1. Update systemu (apt)
+# 2. Zakladni baliky (btop, mc, tree, curl, wget, git, ...)
+# 3. Uzivatel deploy (UID 1000, heslo zamknuto)
+# 4. SSH klice (z keychainu / group_vars)
+# 5. Docker Engine + Compose plugin
+# 6. Uzivatel deploy v docker group (docker bez sudo)
+# 7. Adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
+# 8. fail2ban (SSH jail)
+#
+# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele.
+# Pro produkcni nasazeni doporucujeme nastavit firewall externe
+# (Cloudflare Tunnel, security group na VPS, docker-network oddeleni, ...).
+#
+# Pouziti:
+#   # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
+#   # 2. ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
+#
+# Co playbook predpoklada:
+# - Server ma Ubuntu 22.04 nebo 24.04 LTS
+# - Pristup pres SSH s heslem (root nebo sudo user) pro ansible_become
+# - V inventory.yml je nastaven ansible_host, ansible_user (s sudo prava)
+#
+- name: Priprav novy Ubuntu server
+  hosts: homeservers
+  become: true
+  gather_facts: true
+
+  vars:
+    # Default pro prepare-new-server.yml - lze prepsat v inventory
+    ssh_port: 22
+    fail2ban_maxretry: 5
+    fail2ban_bantime: 3600  # 1 hodina
+
+  pre_tasks:
+    - name: Varovani pred spustenim
+      ansible.builtin.pause:
+        prompt: |
+
+          ============================================
+          PRIPRAVA NOVEHO SERVERU
+
+          Tento playbook:
+          - updatuje system
+          - vytvori deploy usera (UID 1000)
+          - nahraje SSH klice
+          - nainstaluje Docker + Compose
+          - vytvori adresarovou strukturu
+          - nainstaluje fail2ban
+
+          SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
+          Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
+
+          Pokracovat? (Enter = ano, Ctrl+C = prerusit)
+          ============================================
+      when: confirm_run | default(true) | bool
+
+  roles:
+    - role: zaklad
+      tags: [zaklad, base]
+    - role: uzivatel-deploy
+      tags: [uzivatel, deploy]
+    - role: ssh-klice
+      tags: [ssh, klice]
+    - role: docker
+      tags: [docker]
+    - role: adresare
+      tags: [adresare, docker]
+
+  post_tasks:
+    - name: Nainstaluj fail2ban
+      ansible.builtin.apt:
+        name:
+          - fail2ban
+        state: present
+        update_cache: true
+
+    - name: Nastav fail2ban jail pro SSH
+      ansible.builtin.copy:
+        dest: /etc/fail2ban/jail.local
+        content: |
+          [DEFAULT]
+          bantime  = {{ fail2ban_bantime }}
+          findtime = 10m
+          maxretry = {{ fail2ban_maxretry }}
+
+          [sshd]
+          enabled = true
+          port    = {{ ssh_port }}
+          filter  = sshd
+          logpath = /var/log/auth.log
+          maxretry = {{ fail2ban_maxretry }}
+        mode: "0644"
+      notify: Restart fail2ban
+
+    - name: Aktivuj fail2ban
+      ansible.builtin.systemd:
+        name: fail2ban
+        state: started
+        enabled: true
+
+    - name: Vypis stav serveru
+      ansible.builtin.debug:
+        msg: |
+          ============================================
+          SERVER PRIPRAVEN
+
+          SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }}
+          Docker: docker --version (bez sudo)
+          Sluzby: /home/{{ deploy_user }}/docker/<sluzba>/
+
+          Dalsi kroky:
+          1. SSH jako deploy: ssh deploy@<server-ip>
+          2. Klonuj docker services: git clone http://<server-ip>:3000/mates/mates-docker-services.git
+          3. Nasaď Portainer: cd docker/portainer && docker compose up -d
+
+          ============================================
+
+  handlers:
+    - name: Restart fail2ban
+      ansible.builtin.systemd:
+        name: fail2ban
+        state: restarted