Fix NATS provisioning for hosts where the bot user lacks passwordless sudo

Fix NATS provisioning for hosts where the bot user lacks passwordless sudo

nats_server.yml's tasks use become: true, which worked fine on munin (the
"pi" user has passwordless sudo) but hung waiting for a sudo password
prompt on aero2k.de, where "jabberbot" doesn't - discovered deploying NATS
there for the first time.

Moved "provision local nats server" into deploy.yml's first play, which
already connects as root directly (no become needed at all), instead of
the second play that connects as botuser. Also switched from a raw
include_tasks path to include_role(tasks_from: nats_server), since a bare
include_tasks doesn't pull in the role's defaults/main.yml (nats_version
was undefined otherwise) while include_role does regardless of which
tasks file is requested.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>