Fix issues 3,5,6,7,8,9,11,15,16: security hardening and reliability improvements

- ansible.cfg: enable host_key_checking (closes #1)
- update_upgrade.yml: fix reboot crash on non-Debian hosts, exclude AnsibleHost from targets (closes #2, #7)
- deploy.yml: replace silent ignore_errors with real container health assertion (closes #3)
- redeploy.yml: same assertion fix + restic --overwrite always + RESTIC_RESTORE_PATH variable (closes #3, #4, #5)
- disaster.yml: same fixes as redeploy.yml (closes #3, #4, #5)
- docker_update_containers.yml: create missing playbook (closes #6)
- fresh_install.yml: add safety guard to abort if containers already running (closes #8)
- docker_status.yml: add become: true (closes #9)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

playbooks/fresh_install.yml

@@ -5,6 +5,22 @@
   gather_facts: true
 
   tasks:
+    - name: Check if Docker containers are already running (safety guard)
+      ansible.builtin.shell: docker compose ps -q 2>/dev/null || true
+      args:
+        chdir: ~/docker
+      register: running_containers
+      changed_when: false
+      failed_when: false
+
+    - name: Abort if containers are already running on this host
+      ansible.builtin.fail:
+        msg: >
+          Docker containers are already running on {{ inventory_hostname }}.
+          Use redeploy.yml to restore from backup or deploy.yml to redeploy config.
+          Only run fresh_install.yml on hosts with no active containers.
+      when: running_containers.stdout != ""
+
     - name: Update apt cache (Debian/Ubuntu)
       apt:
         update_cache: yes
@@ -61,7 +77,7 @@
         name: '*'
         state: latest
       when: ansible_os_family == 'RedHat'
-    
+
     - name: Update Restic Binaries
       ansible.builtin.command:
         cmd: restic self-update