feat: vollst. Installations-Doku, Ansible-Rollen ausimplementiert, claude_workspace-Rolle

- docs/installation.md: Netinstall + Dualboot Schritt-für-Schritt (LUKS nur am Notebook)
- docs/postinstall-ansible.md: Ablauf + restmanuelle Schritte
- roles/base: APT-Sources mit non-free-firmware + Backports, Locale, Tastatur, Zeitzone, Grundpakete
- roles/desktop_kde: Plasma 6 + SDDM (ohne Recommends, kompakt)
- roles/hardening: SSH key-only, UFW, unattended-upgrades
- roles/dev_tools: Node.js via NodeSource, Python, Perl, Git-Defaults
- roles/workstation_apps: Firefox, Thunderbird, LibreOffice, Codecs, KeePassXC
- roles/claude_workspace (NEU): Claude Code + ccusage, SSH-Key für Gitea, Workspace-Clone (recurse-submodules), ~/.claude/settings.json
- site.yml: alle Rollen mit Tags

ansible/site.yml

@@ -3,8 +3,15 @@
   hosts: workstations
   gather_facts: true
   roles:
-    - base
-    - desktop_kde
-    - hardening
-    - dev_tools
-    - workstation_apps
+    - role: base
+      tags: [base]
+    - role: hardening
+      tags: [hardening]
+    - role: dev_tools
+      tags: [dev_tools]
+    - role: desktop_kde
+      tags: [desktop, kde]
+    - role: workstation_apps
+      tags: [apps]
+    - role: claude_workspace
+      tags: [claude_workspace, claude]