Provision replacement Murmur control server

Provision the retired Murmur control host's low-cost replacement in the existing Scaleway project. Selected shape: - Zone: fr-par-2 - Type: DEV1-S (2 vCPU, 2 GiB RAM) - Image: Ubuntu 24.04 Noble - Root: 20 GB SBS 5K block storage - Reserved routed IPv4 - Existing `murmur-control` security group, corrected to expose SSH, HTTP/HTTPS and monitoring but not port 8080 - Expected baseline cost: about €6.55/month compute + €2.92/month IPv4 + €1.90/month storage, before tax Scope: - Bootstrap the `ansible` automation account from the repository public key using cloud-init without embedding secrets. - Update the Ansible inventory to the new address. - Update the worker security group to allow port 8080 only from the new control-plane IP. - Preserve the reserved address as the DNS target and document all resource IDs/state. - Do not deploy Murmur or create DNS until the host baseline and pending production blockers are ready. Acceptance criteria: - A tagged DEV1-S Instance with reserved IPv4 and 20 GB SBS exists and is reachable for automation. - The control security group allows 80/443, removes public 8080, and retains required SSH/monitoring access. - The worker security group trusts only the replacement control IP for worker port 8080. - Ansible inventory and rendered firewall state use the replacement IP with no stale `51.159.153.160` references. - Host bootstrap and baseline convergence pass without secret-store access during provisioning. Provisioned resources: - Instance `murmur-control-1`: `27065fc6-98d3-4ffa-98fc-270d0a91f922`, running DEV1-S in fr-par-2. - Reserved IPv4: `151.115.147.97` (`e0ab7918-ea5c-4c35-9e8a-d2770123766b`). - Root SBS volume: `1a2dc8c3-5f17-42c6-bd61-e56eb7ea9c30`, 20,000,000,000 bytes, in use. - SSH is reachable. Ports 80/443/8080/9100 are not serving before baseline/application deployment. - Control security group now allows 22, 80, 443 and monitoring 9100; public 8080 is removed. - Worker security-group port 8080 now trusts only `151.115.147.97/32`. - The isolated Ansible branch inventory contains the replacement IP and no stale retired address. Verified baseline: - The owner explicitly authorized SSH. Host-key trust was established for the new address, the cloud-init `ansible` account has passwordless sudo, and cloud-init completed successfully. - The access, users, SSH hardening, unattended upgrades, Docker, firewall and node-exporter roles converged successfully without deploying Murmur. - A second identical baseline run completed with zero changes. - Docker 29.9.0 and Compose 5.6.0 are active; the Ansible firewall service is active; only node exporter is running; the root filesystem has about 15 GB free after baseline installation. - SSH is reachable, root keys are removed by policy, and application ports remain without listeners until deployment.