Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

docs/secrets.md

@@ -0,0 +1,16 @@
+# Secrets
+
+Do not commit passwords, API keys, issued certificates, private keys, or `.env`
+files containing secrets.
+
+This repository is ready for these future integrations:
+
+- Ansible Vault
+- SOPS
+- HashiCorp Vault
+- Smallstep certificates
+
+Role defaults deliberately use `CHANGE_ME_IN_VAULT` placeholders for required
+application secrets. Override those values in encrypted inventory data before
+deploying real services.
+