feat: initial infra repo

- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower)
- install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore
- ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton
- hermes-install: Hermes CLI setup on macOS
- macos-setup: Brewfile + osx-defaults + fish-config
- home-nas-tools: metadata index for NAS projects (no binaries)
- docs: architecture, security, contributing
- README, LICENSE (MIT), .gitignore

.gitignore

@@ -0,0 +1,71 @@
+# =================================================================
+# .gitignore pro mates-infra
+# =================================================================
+
+# Secrets — NIKDY necommituj
+.env
+.env.local
+*.env.local
+*.pem
+*.key
+*.crt
+secrets/
+*.secret
+
+# Backup soubory (velké, nepatří do gitu)
+*.tar.gz
+*.tar.bz2
+*.7z
+*.zip
+*.rar
+*.tar
+
+# Media
+*.iso
+*.img
+*.vhd
+*.vmdk
+*.qcow2
+*.dmg
+
+# Logy
+*.log
+logs/
+
+# Database
+*.db
+*.sqlite
+*.sqlite3
+
+# Docker data (perzistentní volumes, nikdy v gitu)
+docker-data/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+.DS_Store
+Thumbs.db
+
+# OS
+.Trash-*
+$RECYCLE.BIN/
+
+# Pracovní adresáře
+*.tmp
+*.bak
+*~
+
+# Node / Python
+node_modules/
+__pycache__/
+*.pyc
+*.pyo
+
+# Ansible
+*.retry
+*.pyc
+inventory.yml
+group_vars/all/vault.yml
+roles/*/vars/main.yml
+*.bak