feat: vollst. Installations-Doku, Ansible-Rollen ausimplementiert, claude_workspace-Rolle

- docs/installation.md: Netinstall + Dualboot Schritt-für-Schritt (LUKS nur am Notebook)
- docs/postinstall-ansible.md: Ablauf + restmanuelle Schritte
- roles/base: APT-Sources mit non-free-firmware + Backports, Locale, Tastatur, Zeitzone, Grundpakete
- roles/desktop_kde: Plasma 6 + SDDM (ohne Recommends, kompakt)
- roles/hardening: SSH key-only, UFW, unattended-upgrades
- roles/dev_tools: Node.js via NodeSource, Python, Perl, Git-Defaults
- roles/workstation_apps: Firefox, Thunderbird, LibreOffice, Codecs, KeePassXC
- roles/claude_workspace (NEU): Claude Code + ccusage, SSH-Key für Gitea, Workspace-Clone (recurse-submodules), ~/.claude/settings.json
- site.yml: alle Rollen mit Tags

ansible/roles/desktop_kde/tasks/main.yml

@@ -1,3 +1,39 @@
 ---
-# KDE Plasma 6, SDDM, KDE-Anwendungen
-# TODO: implementieren — Skeleton-Datei
+- name: KDE Plasma + SDDM (Standardumfang ohne riesige Discover-Hänger)
+  ansible.builtin.apt:
+    name:
+      - kde-plasma-desktop
+      - sddm
+      - plasma-nm
+      - plasma-pa
+      - kde-config-sddm
+      - konsole
+      - dolphin
+      - kate
+      - okular
+      - gwenview
+      - spectacle
+      - ark
+      - kcalc
+      - kfind
+      - partitionmanager
+      - xdg-utils
+      - fonts-noto
+      - fonts-noto-color-emoji
+    state: present
+    install_recommends: false
+
+- name: SDDM aktivieren als Default-Display-Manager
+  ansible.builtin.copy:
+    dest: /etc/X11/default-display-manager
+    mode: '0644'
+    content: "/usr/bin/sddm\n"
+
+- name: Graphical Target als Default
+  ansible.builtin.command: systemctl set-default graphical.target
+  changed_when: false
+
+- name: SDDM aktivieren
+  ansible.builtin.systemd:
+    name: sddm
+    enabled: true