Generate WordPress compose from the site list during provision.

Each host mounts wp-content and gets a compose file from inventory instead of a hand-copied one. Also allow LAN TCP 8020 so abc_voice is reachable through UFW.

IMPLEMENTATION.md

@@ -58,12 +58,13 @@ server-infra/
 │   ├── hosts.yml
 │   ├── group_vars/
 │   │   └── all.yml         # vars + app_catalog
-│   └── host_vars/
-│       ├── adama.yml       # host_apps (django + static; monica worker)
-│       ├── roslin.yml      # host_apps (mirrors adama, no worker)
-│       ├── starbuck.yml    # host_apps (mirrors roslin)
-│       ├── apollo.yml      # host_apps (mirrors roslin)
-│       └── ai-server-4080.yml  # control node / act runner / SearxNG / observability
+│   ├── host_vars/
+│   │   ├── adama.yml       # host_apps (django + static; monica worker)
+│   │   ├── roslin.yml      # host_apps (mirrors adama, no worker)
+│   │   ├── starbuck.yml    # host_apps (mirrors roslin)
+│   │   ├── apollo.yml      # host_apps (mirrors roslin)
+│   │   └── ai-server-4080.yml  # control node / act runner / SearxNG / observability
+│   └── wordpress_sites.yml # WordPress NFS mounts + generated compose inputs
 ├── playbooks/
 │   ├── site.yml            # Phase 1: provision
 │   ├── deploy-apps.yml     # Phase 2: CI deploy
@@ -79,7 +80,8 @@ server-infra/
 │   ├── searxng/            # SearxNG JSON API for chat_backend (#10)
 │   ├── alloy/              # log/metrics shipper
 │   ├── app-deploy/         # django (docker) + node-static deploy
-│   └── web-static/         # nginx container serving /var/www builds
+│   ├── web-static/         # nginx container serving /var/www builds
+│   └── wordpress/          # NFS wp-content + compose rendered per site
 └── scripts/
     ├── provision.sh        # Wrapper with --limit support
     ├── deploy.sh           # Wrapper for deploy playbook
@@ -197,7 +199,7 @@ Applies roles in order to the `webservers` group:
 
 | Role | Purpose |
 |------|---------|
-| `common` | apt update, git, python3, pip, curl, ca-certificates |
+| `common` | apt update, git, python3, pip, curl, ca-certificates, nfs-common |
 | `ufw` | Firewall: SSH from LAN only, HTTP/HTTPS public |
 | `docker` | Docker CE, compose plugin, add `westfarn` to `docker` group |
 | `nodejs` | Node.js + npm + npx (NodeSource) for `dta_webapp` builds |