Initial commit: arr-stack homelab + local AI

Docker Compose media stack (gluetun, *arr, Jellyfin), Ternary-Bonsai AI
(Open WebUI, Forgejo, optional OpenHands), and Ansible bootstrap for the
SER5 Ubuntu host.

wireguard/wg0.conf.example

@@ -0,0 +1,27 @@
+# Rename YOUR provider's config file to `wg0.conf` and put it in this folder.
+# It looks roughly like this:
+#
+#   [Interface]
+#   PrivateKey = yAnz..................................=
+#   Address = 10.2.0.2/32
+#   DNS = 10.2.0.1
+#
+#   [Peer]
+#   PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
+#   PresharedKey = ......................................=   # only if present
+#   AllowedIPs = 0.0.0.0/0
+#   Endpoint = 185.159.157.12:51820
+#
+# Two required edits before gluetun accepts it:
+#
+# 1. Remove any IPv6 addresses from the Address and DNS lines, e.g.
+#      Address = 10.182.160.190/32, fd7d:76ee:...::/128
+#    becomes
+#      Address = 10.182.160.190/32
+#
+# 2. The Endpoint must be an IP address, not a hostname. If yours says
+#    something like `Endpoint = se3.vpn.example.org:51820`, resolve it first:
+#      dig +short se3.vpn.example.org
+#    and paste the IP back into the file.
+#
+# Keep AllowedIPs = 0.0.0.0/0 as-is; gluetun handles the routing itself.