feat: bootstrap and harden Railiance01 at HostEurope

- Extend base role with fail2ban, UFW k3s/Flannel rules, HISTCONTROL
- Add handlers dir for fail2ban restart
- Fix inventory script to emit correct dynamic inventory JSON format
- Add roles_path to ansible.cfg so playbook finds roles
- Add Railiance01 (92.205.62.239) to inventory/servers.yaml
- Mark workplan T03/T04/T05 as done

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/base/tasks/main.yml

@@ -8,6 +8,7 @@
       - git
       - vim
       - ufw
+      - fail2ban
       - python3
       - python3-venv
     state: present
@@ -40,6 +41,49 @@
     rule: allow
     name: OpenSSH
 
+- name: Allow k3s API in UFW
+  ansible.builtin.ufw:
+    rule: allow
+    port: '6443'
+    proto: tcp
+
+- name: Allow Flannel VXLAN in UFW
+  ansible.builtin.ufw:
+    rule: allow
+    port: '8472'
+    proto: udp
+
+- name: Enable fail2ban
+  ansible.builtin.service:
+    name: fail2ban
+    state: started
+    enabled: true
+
+- name: Configure fail2ban SSH jail
+  ansible.builtin.copy:
+    dest: /etc/fail2ban/jail.d/sshd.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      [sshd]
+      enabled = true
+      port    = ssh
+      filter  = sshd
+      maxretry = 5
+      bantime  = 3600
+      findtime = 600
+  notify: Restart fail2ban
+
+- name: Set HISTCONTROL to ignorespace
+  ansible.builtin.copy:
+    dest: /etc/profile.d/histcontrol.sh
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      export HISTCONTROL=ignorespace
+
 - name: Set timezone
   community.general.timezone:
     name: "{{ timezone | default('UTC') }}"