arbret: our side of running it on vipy

prd-arbret was folded into vipy. arbret itself (app, worker, Postgres, timers,
its backup dump) is deployed by its owner's own repo; this repo owns the
shared host's side of it. arbret_handoff.md documents the split, the Gatus
push API and the backup contract.

- services/arbret: arbret.com -> localhost:3100, www redirects to the apex,
  port 4117 allowed on tailscale0 only, /opt/backups/arbret pre-created to
  the contract so the pull job is green before the first dump.
- headscale ACL: framie may reach prd-vipy:4117.
- vipy: arbret-server, arbret-worker and postgresql in the unit checks.
- 402: DNS and HTTP checks for arbret.com, www, and /api/health with
  [BODY].status == ok. Entries may now name an fqdn outside root_domain and
  add conditions.
- 403: probes arbret-analytics (hourly, 130m window) and arbret-beancount
  (daily, 26h), pushing with the dedicated arbret token.
- backups: pull from backup-pull@prd-vipy:/opt/backups/arbret/, and a
  backup-dump_arbret endpoint.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ansible/site.yml

@@ -65,6 +65,7 @@
 - import_playbook: services/forgejo/deploy_forgejo_playbook.yml
 - import_playbook: services/lnbits/deploy_lnbits_playbook.yml
 - import_playbook: services/personal-blog/deploy_personal_blog_playbook.yml
+- import_playbook: services/arbret/deploy_arbret_edge_playbook.yml
 
 # ── Backups: each source dumps itself, the box pulls ────────────────────────
 - import_playbook: services/headscale/setup_backup_headscale.yml