Apply Railiance01 firewall-only converge and close RAIL-HO-WP-0009

Operator-approved playbooks/firewall.yaml --tags firewall removed the
three public 6443 grants. Live UFW now matches ADR-005 (OpenSSH + Nydus).

ansible/playbooks/firewall.yaml

@@ -0,0 +1,9 @@
+---
+# Firewall-only converge. Does not load SOPS secrets or other bootstrap roles.
+# Usage: make converge-firewall HOST=Railiance01
+- hosts: all
+  become: true
+  vars_files:
+    - ../inventory/group_vars/all.yaml
+  roles:
+    - role: base