ci: add deploy-netbird-server pipeline (mirrors deploy-caddy)

The netbird-server role had no deploy pipeline, so pinning its image
versions (#32) landed in git but never reached the VPS — there was
nothing to run install-netbird-server.yml. Every other Ansible-managed
service (caddy-ha, …) has a path-triggered deploy-* pipeline that runs
its play in the ci-ansible runner; netbird-server was simply missing one.

This mirrors deploy-caddy.yml exactly: push-triggered on the role, the
play, and this file; manual via PIPELINE==deploy-netbird-server. Merging
this re-triggers on its own path and runs install-netbird-server.yml,
applying the pinned 0.73.2 / v2.80.0 images on netbird.renner.uno.

Note: a management bump runs a one-way store migration — snapshot the
VPS before merging if the live version is well behind 0.73.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.woodpecker/deploy-netbird-server.yml

@@ -0,0 +1,35 @@
+when:
+  - event: push
+    path:
+      - "ansible/roles/netbird-server/**"
+      - "ansible/plays/install-netbird-server.yml"
+      - ".woodpecker/deploy-netbird-server.yml"
+  - event: manual
+    evaluate: 'PIPELINE == "deploy-netbird-server"'
+
+timeout: 30
+
+steps:
+  - name: deploy-netbird-server
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+      PROXMOX_TOKEN_ID:
+        from_secret: proxmox_token_id
+      PROXMOX_TOKEN_SECRET:
+        from_secret: proxmox_token_secret
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/install-netbird-server.yml -v