ansible: scaffold dangerousthings.authforge role skeleton

Adds meta/main.yml (Galaxy metadata for Ubuntu 22.04/24.04 under the
Apache-2.0 license), defaults/main.yml covering the policy/storage/
firstrun/pending knobs the tasks layer will consume, and a single
restart-daemon handler. Tasks and template land in the next commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ansible-role/defaults/main.yml

@@ -0,0 +1,31 @@
+---
+# Whether to additionally pull the GUI package. Headless fleets should leave
+# this off; desktop fleets that want the AuthForge settings panel can flip it.
+authforge_install_gui: false
+
+# PPA to install from. Override if you mirror packages internally.
+authforge_ppa: "ppa:dangerousthings/authforge"
+
+# Map of stack name -> { mode, methods }. mode is one of
+# "disabled" | "optional" | "required". methods is a list e.g. ["fido2", "totp"].
+# Default is empty so the role can be applied for "install only" runs.
+authforge_stacks: {}
+
+# Credential storage backend. "per-user" stores credentials under each user's
+# home directory; "central" stores them at authforge_storage_central_path so
+# they survive home-directory wipes (e.g. AD-managed boxes).
+authforge_storage_backend: "per-user"
+authforge_storage_central_path: ""
+
+# First-login enforcement. Users who exist in the pending list will be required
+# to enroll one of these methods on their next interactive login.
+authforge_firstrun_methods:
+  - "fido2"
+
+# How long after the pending flag is set before the user is locked out if they
+# have not enrolled. 0 means no deadline (warn forever).
+authforge_firstrun_deadline_hours: 0
+
+# Users to mark as pending-enrollment via `authforgectl pending set`.
+# Each entry: { user: "alice", methods: ["fido2"] }.
+authforge_pending_users: []