feat: template pds.env with Ansible-managed config

Reads installer-generated secrets from pds.env and re-templates it with
config from vars/main.yml (S3, SMTP, blob limits, etc.). Secrets are
preserved across runs; only config changes trigger a restart.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

playbook.yml

@@ -1,8 +1,15 @@
 ---
 - name: Deploy PDS
   hosts: pds
+  become: yes
   vars_files:
     - vars/main.yml
+  vars:
+    pds_data_dir: /pds
+    pds_image_tag: "0.4"
+    pds_blob_upload_limit: 104857600
+    pds_rate_limits_enabled: true
+    pds_invite_required: true
 
   tasks:
     - name: Run PDS installer (first time only)
@@ -12,6 +19,25 @@
         {{ pds_data_dir }} {{ pds_hostname }} {{ pds_admin_email }}
       args:
         creates: "{{ pds_data_dir }}/account.sqlite"
+        executable: /bin/bash
+
+    - name: Read existing secrets from pds.env
+      shell: grep -E '^(PDS_JWT_SECRET|PDS_ADMIN_PASSWORD|PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)=' {{ pds_data_dir }}/pds.env
+      register: existing_secrets
+      changed_when: false
+
+    - name: Set secret facts
+      set_fact:
+        pds_jwt_secret: "{{ existing_secrets.stdout_lines | select('match', '^PDS_JWT_SECRET=') | first | regex_replace('^PDS_JWT_SECRET=', '') }}"
+        pds_admin_password: "{{ existing_secrets.stdout_lines | select('match', '^PDS_ADMIN_PASSWORD=') | first | regex_replace('^PDS_ADMIN_PASSWORD=', '') }}"
+        pds_plc_rotation_key: "{{ existing_secrets.stdout_lines | select('match', '^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=') | first | regex_replace('^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=', '') }}"
+
+    - name: Deploy pds.env
+      template:
+        src: templates/pds.env.j2
+        dest: "{{ pds_data_dir }}/pds.env"
+        mode: "0600"
+      notify: apply changes
 
     - name: Deploy compose.yaml
       template: