Add the prepare-server playbook

Two plays: bootstrap as the provider account (ubuntu, over bootstrap.pem), then
everything else as the user that first play just created. The split is forced
rather than stylistic -- the second play logs in as that user, so its
authorized_keys entry and its NOPASSWD sudoers entry both have to exist before
it starts. That is why the key tasks live in the 'user' role and 'wheel' runs
in the first play: move either into play 2 and it fails with an auth error or
"Missing sudo password".

Both accounts and both keys are variables. The inventory sits beside the
playbook and is read via ansible.cfg, which Ansible picks up from the current
working directory rather than the playbook's, so it has to be run from this
directory. bootstrap.pem is gitignored -- it is the provider key for the host.

prepare-server/roles/zsh/tasks/main.yml

@@ -0,0 +1,75 @@
+---
+- name: Install ZSH and required packages
+  ansible.builtin.package:
+    name:
+      - zsh
+      - tmux
+      - powerline
+      - git
+    state: present
+    update_cache: true
+
+- name: Change default shell to ZSH
+  ansible.builtin.user:
+    name: "{{ user }}"
+    shell: /bin/zsh
+
+- name: Check if oh-my-zsh is already installed
+  ansible.builtin.stat:
+    path: "/home/{{ user }}/.oh-my-zsh"
+  register: oh_my_zsh_stat
+
+- name: Install oh-my-zsh
+  ansible.builtin.git:
+    repo: https://github.com/robbyrussell/oh-my-zsh.git
+    dest: "/home/{{ user }}/.oh-my-zsh"
+    depth: 1
+  when: not oh_my_zsh_stat.stat.exists
+  become: true
+  become_user: "{{ user }}"
+
+- name: Install zsh-autosuggestions plugin
+  ansible.builtin.git:
+    repo: https://github.com/zsh-users/zsh-autosuggestions
+    dest: "/home/{{ user }}/.oh-my-zsh/custom/plugins/zsh-autosuggestions"
+    depth: 1
+  become: true
+  become_user: "{{ user }}"
+
+- name: Install zsh-syntax-highlighting plugin
+  ansible.builtin.git:
+    repo: https://github.com/zsh-users/zsh-syntax-highlighting.git
+    dest: "/home/{{ user }}/.oh-my-zsh/custom/plugins/zsh-syntax-highlighting"
+    depth: 1
+  become: true
+  become_user: "{{ user }}"
+
+- name: Ensure .zshrc exists (copy template if needed)
+  ansible.builtin.copy:
+    src: "/home/{{ user }}/.oh-my-zsh/templates/zshrc.zsh-template"
+    dest: "/home/{{ user }}/.zshrc"
+    remote_src: true
+    force: false
+    owner: "{{ user }}"
+    group: "{{ user }}"
+    mode: "0644"
+
+- name: Set ZSH theme to agnoster
+  ansible.builtin.replace:
+    path: "/home/{{ user }}/.zshrc"
+    regexp: 'ZSH_THEME="robbyrussell"'
+    replace: 'ZSH_THEME="agnoster"'
+
+- name: Enable ZSH plugins
+  ansible.builtin.replace:
+    path: "/home/{{ user }}/.zshrc"
+    regexp: 'plugins=\(git\)'
+    replace: "plugins=(git zsh-autosuggestions zsh-syntax-highlighting)"
+
+- name: Add custom aliases to .zshrc
+  ansible.builtin.lineinfile:
+    path: "/home/{{ user }}/.zshrc"
+    line: "alias ls='ls --color=auto --indicator-style=slash --human-readable --format=long'"
+    create: true
+    owner: "{{ user }}"
+    group: "{{ user }}"