Add LubeLogger deployment (docker-node01)

Ansible-managed (inline-compose, file-provider router, host :8099), idempotent
(changed=0). PBS-backed pg_dump (daily, keep 14) with verified round-trip restore;
ntfy 'garage' reminder probe (.190); Diun repo-watch for new tags; Homepage
tile+widget. Secrets via ansible-vault / /etc env files / HOMEPAGE_VAR — none in repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lubelogger/README.md

@@ -0,0 +1,50 @@
+# LubeLogger — deployment source of truth
+
+Vehicle & small-engine maintenance tracker. **Host:** docker-node01 (.186).
+Postgres 18 backend (tables in the `app` schema). In-app auth ENABLED (root user).
+
+## Routing (file provider)
+Published on the host at `:8099`; Traefik on node01 routes `lubelogger.goattw.net`
+→ `http://192.168.99.186:8099` via `dynamic_conf.yml` (see `traefik-router.dynamic_conf.yml`).
+Edge chain: TLS (letsencrypt) → CrowdSec (global) → Authelia (`authelia-auth@file`,
+`two_factor` off-LAN / bypass on-LAN). LubeLogger's own auth gates the LAN/`:8099` path.
+
+## Deploy (Ansible, idempotent)
+Playbook `deploy-lubelogger.yml` (runs from `~/ansible` on ansible-control):
+```
+ansible-playbook playbooks/deploy-lubelogger.yml
+```
+Inline-compose house style: `copy:` the compose + `community.docker.docker_compose_v2`.
+DB password is sourced from ansible-vault (`vault_lubelogger_db_password`) — never inline.
+Second converge is `changed=0`.
+
+## Backup (PBS)
+`lubelogger-backup.{sh,service,timer}` on node01 — daily 03:30, `pg_dump` → PBS
+(`rust-usb`, host/lubelogger), prune `--keep-daily 14`. PBS creds live in
+`/etc/lubelogger-backup.env` (root:600, NOT in git). Restore verified via full
+PBS round-trip into a throwaway postgres:18 (live↔restored row-count parity).
+NOTE: the `lubelogger-data`/`lubelogger-keys` volumes (uploads, config, the ROOT USER
+credential, ASP.NET keyring) are a SEPARATE layer — covered by docker-volume-backup
+(`stop-during-backup` labels already set). pg_dump captures Postgres data only.
+
+## Reminders → ntfy
+`lubelogger-reminders-probe.{sh}` + units on ansible-control (.190) — daily 07:30.
+Reads `/api/vehicle/info` (Basic auth, creds in `/etc/lubelogger-reminders.env`,
+root:600, NOT in git), posts a digest to ntfy topic **garage** only when something is
+due/overdue. Subscribe to the `garage` topic in your ntfy app to receive it.
+
+## Diun
+App carries `diun.watch_repo=true` + semver `include_tags` so a new release tag pings
+the existing Diun→HA-webhook pipeline. DB (`postgres:18`) is watched by default (digest).
+
+## Homepage
+Tile + `lubelogger` widget under "AI & Productivity" in
+`observability/homepage/services.yaml` (live) — widget password via
+`HOMEPAGE_VAR_LUBELOGGER_PASSWORD` (observability/.env, not a git repo). See
+`homepage-tile.yaml`.
+
+## Secrets (none in this repo)
+- DB password: ansible-vault (`~/ansible`), and Postgres volume (already initialized).
+- PBS token: `/etc/lubelogger-backup.env` (reuses vaultwarden token — a dedicated
+  `lubelogger-backup` PBS token would be cleaner; needs PBS root to create).
+- Admin/basic-auth password: `/etc/lubelogger-reminders.env` + `observability/.env`.