Add the prepare-server playbook

Two plays: bootstrap as the provider account (ubuntu, over bootstrap.pem), then
everything else as the user that first play just created. The split is forced
rather than stylistic -- the second play logs in as that user, so its
authorized_keys entry and its NOPASSWD sudoers entry both have to exist before
it starts. That is why the key tasks live in the 'user' role and 'wheel' runs
in the first play: move either into play 2 and it fails with an auth error or
"Missing sudo password".

Both accounts and both keys are variables. The inventory sits beside the
playbook and is read via ansible.cfg, which Ansible picks up from the current
working directory rather than the playbook's, so it has to be run from this
directory. bootstrap.pem is gitignored -- it is the provider key for the host.

prepare-server/ansible.cfg

@@ -0,0 +1,15 @@
+# Ansible configuration for the prepare-server playbook.
+#
+# This file is only read when you run ansible-playbook from this directory.
+# Ansible looks for ansible.cfg in the *current working directory*, not next to
+# the playbook, so:
+#
+#   cd prepare-server && ansible-playbook playbook.yml   # reads this file
+#   ansible-playbook prepare-server/playbook.yml         # ignores it, falls
+#                                                        # back to /etc/ansible/hosts
+#
+# That fallback is silent, so if a host is missing from the inventory below it
+# is worth checking which inventory actually got used.
+
+[defaults]
+inventory = inventory