chore: refined control script

ansible/group_vars/all.yml

@@ -1,8 +1,9 @@
 ---
-# Keep in sync with infra/variables.tf's var.deploy_user (default "deploy") -
-# the two aren't wired together automatically, since Ansible no longer reads
-# any Terraform state or output.
-deploy_user: deploy
+# Non-root sudo user the bootstrap role creates on each host - purely an
+# Ansible-side concept, OpenTofu has no equivalent variable. Override with the
+# DEPLOY_USER env var (control.sh's "Set variables" menu writes it) if you
+# don't want the default.
+deploy_user: "{{ lookup('env', 'DEPLOY_USER') | default('deploy', true) }}"
 ansible_user: "{{ deploy_user }}"
 ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE') | default('~/.ssh/id_ed25519', true) }}"