refactor: ceske nazvy playbooku a roli bez diakritiky

Playbooky (novy nazev -> co dela):
- priprav-novy-server.yml (kompletni setup noveho serveru)
- nasad-sluzby.yml (nasadi Docker sluzby z docker-services/)
- aktualizuj-sluzby.yml (docker compose pull && up -d)
- zabezpec-server.yml (sysctl, auditd, unattended-upgrades)
- bootstrap-server.yml SMAZAN (duplicitni s priprav-novy-server)

Role (novy nazev -> co dela):
- zaklad (update + base baliky + timezone)
- uzivatel-deploy (vytvori deploy usera UID 1000)
- ssh-klice (authorized_keys deployment)
- docker (Docker Engine + Compose plugin) - ponechan anglicky (IT konvence)
- adresare (/home/deploy/{docker,scripts,backups,logs,...})
- firewall SMAZAN (nepouziva se)

Reference v playbooku aktualizovany na nove nazvy roli.
README.md kompletne prepracovan v cestine pro zacatecniky - vysvetluje
co Ansible je, jak nainstalovat, jak vytvorit inventory, jak spustit
playbook, jak overit ze vse funguje.

playbooks/zabezpec-server.yml

@@ -0,0 +1,58 @@
+---
+# Security hardening – sysctl, AppArmor, auditd, auto-updates
+#
+# Pouziti:
+#   ansible-playbook -i inventory.yml playbooks/security-hardening.yml
+#
+- name: Security hardening
+  hosts: homeservers
+  become: true
+
+  tasks:
+    - name: Kernel hardening pres sysctl
+      ansible.posix.sysctl:
+        name: "{{ item.key }}"
+        value: "{{ item.value }}"
+        state: present
+        reload: true
+      loop:
+        - { key: "net.ipv4.conf.all.rp_filter", value: "1" }
+        - { key: "net.ipv4.conf.default.rp_filter", value: "1" }
+        - { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" }
+        - { key: "net.ipv4.conf.all.accept_redirects", value: "0" }
+        - { key: "net.ipv4.conf.default.accept_redirects", value: "0" }
+        - { key: "net.ipv6.conf.all.accept_redirects", value: "0" }
+        - { key: "net.ipv4.conf.all.send_redirects", value: "0" }
+        - { key: "net.ipv4.conf.all.accept_source_route", value: "0" }
+        - { key: "net.ipv4.conf.default.accept_source_route", value: "0" }
+        - { key: "net.ipv4.tcp_syncookies", value: "1" }
+        - { key: "net.ipv4.conf.all.log_martians", value: "1" }
+
+    - name: Instalace unattended-upgrades
+      ansible.builtin.apt:
+        name:
+          - unattended-upgrades
+          - apt-listchanges
+        state: present
+
+    - name: Povol automaticke security updaty
+      ansible.builtin.copy:
+        dest: /etc/apt/apt.conf.d/20auto-upgrades
+        content: |
+          APT::Periodic::Update-Package-Lists "1";
+          APT::Periodic::Unattended-Upgrade "1";
+          APT::Periodic::AutocleanInterval "7";
+        mode: "0644"
+
+    - name: Instalace auditd
+      ansible.builtin.apt:
+        name:
+          - auditd
+          - audispd-plugins
+        state: present
+
+    - name: Aktivuj auditd
+      ansible.builtin.service:
+        name: auditd
+        state: started
+        enabled: true