chore: refined control script

ansible/README.md

@@ -14,16 +14,19 @@ to S3, not on a Hetzner volume - see `../readme.md`.
 - `inventory/hcloud.yml` - dynamic inventory, queries the Hetzner Cloud API
   directly (not Terraform state) and groups servers by their `role` label
   (`role_dev`, `role_prod`, `role_vpn` - set in `infra/modules/<host>/main.tf`).
-- `group_vars/` - `all.yml` (shared: `deploy_user`, SSH key path,
-  `backup_s3_*` S3 backup credentials), `role_dev.yml` / `role_prod.yml` /
-  `role_vpn.yml` (per-role vars, e.g. `service_group`).
 - `roles/bootstrap/` - Docker install, `deploy` user creation, SSH hardening,
   unattended-upgrades. Replaces `infra/scripts/bootstrap.sh.tftpl`.
 - `roles/deploy/` - copies `services/<host>/` to the server and renders `.env`
   (S3 backup credentials, see `../readme.md`) and, for `dev`,
   `Runners/docker-compose.yml`.
 - `playbooks/` - `bootstrap.yml`, `deploy.yml`, `spinup.yml`, `spindown.yml`,
-  and `site.yml` (all three in order).
+  `site.yml` (all three in order), and `group_vars/` (`all.yml` - shared:
+  `deploy_user`, SSH key path, `backup_s3_*` S3 backup credentials;
+  `role_dev.yml` / `role_prod.yml` / `role_vpn.yml` - per-role vars, e.g.
+  `service_group`). `group_vars/` lives here rather than at the `ansible/`
+  root because Ansible only auto-loads `group_vars/`/`host_vars/` from
+  directories adjacent to the playbook file or the inventory source - not
+  from an arbitrary sibling directory.
 
 ## Prerequisites
 
@@ -41,7 +44,7 @@ export BACKUP_S3_ENDPOINT=your-s3-endpoint   # omit for real AWS S3
 persists your answers to `../.control.env` (gitignored) so you don't have to
 re-export them every session.
 
-`deploy_user` (see `group_vars/all.yml`) defaults to `deploy` - override with
+`deploy_user` (see `playbooks/group_vars/all.yml`) defaults to `deploy` - override with
 the `DEPLOY_USER` env var if you want a different non-root user created on each
 host. `ansible_ssh_private_key_file` (same file) defaults to
 `~/.ssh/id_ed25519` - override with `ANSIBLE_SSH_PRIVATE_KEY_FILE` if you use a