Initial monorepo scaffold

Turborepo + pnpm monorepo for k3s homelab cluster on Intel NUCs.

- Apps: Next.js web frontend, Express API (TypeScript, Dockerfiles, k8s manifests)
- Packages: shared UI, ESLint config, TypeScript config, Drizzle DB schemas
- Infra/Ansible: bare-metal provisioning with roles for common, k3s-server, k3s-agent, hardening
- Infra/Kubernetes: ArgoCD GitOps (app-of-apps + ApplicationSets), platform components
  (cert-manager, Traefik, CloudNativePG, Valkey, Longhorn, Sealed Secrets), namespaces
- Observability: kube-prometheus-stack, Loki, Promtail as ArgoCD Applications
- CI/CD: GitHub Actions for PR builds, preview deploys, production deploys
- DX: Taskfile, utility scripts, copier templates, Ubiquiti network docs

infra/ansible/playbooks/k3s-upgrade.yaml

@@ -0,0 +1,49 @@
+---
+- name: Upgrade k3s cluster
+  hosts: k3s_cluster
+  become: true
+  serial: 1
+  vars:
+    k3s_upgrade_version: "{{ k3s_version }}"
+  tasks:
+    - name: Cordon node
+      ansible.builtin.command:
+        cmd: k3s kubectl cordon {{ inventory_hostname }}
+      delegate_to: "{{ groups['servers'][0] }}"
+      changed_when: true
+
+    - name: Drain node
+      ansible.builtin.command:
+        cmd: >-
+          k3s kubectl drain {{ inventory_hostname }}
+          --ignore-daemonsets
+          --delete-emptydir-data
+          --timeout=120s
+      delegate_to: "{{ groups['servers'][0] }}"
+      changed_when: true
+
+    - name: Upgrade k3s
+      ansible.builtin.command:
+        cmd: /tmp/k3s-install.sh
+      environment:
+        INSTALL_K3S_VERSION: "{{ k3s_upgrade_version }}"
+        K3S_TOKEN: "{{ k3s_token }}"
+        INSTALL_K3S_EXEC: "{{ 'server ' + k3s_server_args if k3s_role == 'server' else 'agent ' + k3s_agent_args }}"
+        K3S_URL: "{{ '' if k3s_role == 'server' else k3s_server_url }}"
+      changed_when: true
+
+    - name: Wait for node to be ready
+      ansible.builtin.command:
+        cmd: k3s kubectl get node {{ inventory_hostname }} -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}'
+      delegate_to: "{{ groups['servers'][0] }}"
+      register: node_ready
+      retries: 30
+      delay: 10
+      until: node_ready.stdout == "True"
+      changed_when: false
+
+    - name: Uncordon node
+      ansible.builtin.command:
+        cmd: k3s kubectl uncordon {{ inventory_hostname }}
+      delegate_to: "{{ groups['servers'][0] }}"
+      changed_when: true