Add continuous deployment to mimir via buildbot

Add continuous deployment to mimir via buildbot

New "deploy" step in .ci.toml, master-only and after unit-tests: runs the
existing ansible playbook from a debian container. host_vars/*.yml are
committed ansible-vault encrypted (same vault as deploy/vault.sh); the
vault password file and a dedicated deploy ssh key are mounted from the
buildbot secrets store on heimdall. The playbook now also authorizes that
key for the bot user itself, so only root@mimir needed manual provisioning.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KJp2rEnVtsgbH7FLj3jubx