Add Atlas media and storage services [Phase 1] (#9)

* Add Atlas media and storage services

* Document Atlas backend phase one and WireGuard deployment

* Enable Atlas NAS management and document bootstrap workflow

* Harden Atlas network, SSH, firewall, and sharing

* Rotate Ansible Vault secrets

* Allow configurable Aegis SSH users and authorized keys

* Manage Aegis SSH authorized key fragments

* Manage SSH authorized key fragments for infrastructure hosts

* Harden Rocky storage and sharing configuration

* Verify WireGuard handshakes and restore Podman networking

ansible/roles/profile_backend_phase1/templates/atlas-navidrome.container.j2

@@ -0,0 +1,28 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas rootless Navidrome backend
+
+[Container]
+ContainerName=atlas-navidrome
+Image={{ backend_phase1_navidrome_image }}
+UserNS=keep-id
+User={{ backend_phase1_uid }}
+Group={{ backend_phase1_gid }}
+PublishPort={{ backend_phase1_wireguard_address }}:{{ backend_phase1_navidrome_port }}:4533
+Environment=ND_LOGLEVEL=info
+Environment=ND_SCANSCHEDULE=1h
+Environment=ND_SESSIONTIMEOUT=24h
+Environment=ND_ENABLETRANSCODING=true
+Environment=TZ={{ backend_phase1_timezone }}
+Volume={{ backend_phase1_navidrome_data_dir }}:/data:Z
+Volume={{ backend_phase1_music_dir }}:/music:ro,z
+NoNewPrivileges=true
+DropCapability=all
+
+[Service]
+Restart=always
+RestartSec=10
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target