chore: Cleaned up ansible and added control script

ansible/README.md

@@ -16,7 +16,7 @@ to S3, not on a Hetzner volume - see `../readme.md`.
   (`role_dev`, `role_prod`, `role_vpn` - set in `infra/modules/<host>/main.tf`).
 - `group_vars/` - `all.yml` (shared: `deploy_user`, SSH key path,
   `backup_s3_*` S3 backup credentials), `role_dev.yml` / `role_prod.yml` /
-  `role_vpn.yml` (per-role vars, e.g. `dev_runner_count`).
+  `role_vpn.yml` (per-role vars, e.g. `service_group`).
 - `roles/bootstrap/` - Docker install, `deploy` user creation, SSH hardening,
   unattended-upgrades. Replaces `infra/scripts/bootstrap.sh.tftpl`.
 - `roles/deploy/` - copies `services/<host>/` to the server and renders `.env`
@@ -65,9 +65,10 @@ ansible-playbook playbooks/spinup.yml    -l role_dev,role_prod
 ansible-playbook playbooks/site.yml -l role_dev,role_prod
 ```
 
-Re-run `deploy.yml` + `spinup.yml` any time a compose file changes or
-`dev_runner_count` in `group_vars/role_dev.yml` is bumped - `spinup.sh` only
-starts/updates what's changed, same as before.
+Re-run `deploy.yml` + `spinup.yml` any time a compose file changes - `spinup.sh`
+only starts/updates what's changed, same as before. `dev` always runs three
+Gitea Actions runners (fixed in
+`roles/deploy/templates/runners-docker-compose.yml.j2`).
 
 `spindown.yml` runs `spindown.sh`, which does a full `docker system/volume
 prune -a` on the host - it prompts for a `yes` confirmation before running,