chore: initialize k3s master iac skeleton

ansible/inventory/README.md

@@ -0,0 +1,5 @@
+# Inventory Layout
+
+Terraform will render a dynamic inventory (e.g., via `terraform output` or `ansible-inventory` plugin) exposing the K3s control-plane nodes under the `k3s_master` group.
+
+For local testing, drop an `inventory.ini` or `inventory.yaml` into this directory with the same group name. Keep secrets out of version control; prefer Ansible Vault or CI secret storage.

ansible/playbooks/master-init.yml

@@ -0,0 +1,21 @@
+---
+- name: Bootstrap K3s control-plane node
+  hosts: k3s_master
+  become: true
+  gather_facts: true
+
+  vars:
+    kubeconfig_output: /etc/rancher/k3s/k3s.yaml
+
+  pre_tasks:
+    - name: Assert control-plane requirements are satisfied
+      assert:
+        that:
+          - ansible_os_family is defined
+        fail_msg: "Host facts missing; ensure Ansible inventory is generated post-Terraform"
+
+  roles:
+    # TODO: add hardened OS baseline, container runtime prerequisites, and k3s installation role.
+    - role: placeholder.k3s-master
+      vars:
+        kubeconfig_path: "{{ kubeconfig_output }}"