Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

opsec/configs/opsec.conf

@@ -8,12 +8,13 @@ PROFILE_NAME="default"
 
 # ─── TOR SETTINGS ──────────────────────────────────────────────────────────────
 TOR_CIRCUIT_ROTATION="30"
-TOR_BLACKLIST=""
-TOR_STRICT_NODES="1"
+TOR_BLACKLIST="us,gb,ca,au,nz"
+TOR_STRICT_NODES="0"
 TOR_ISOLATION="1"
 TOR_PADDING="1"
 TOR_SOCKS_PORT="9050"
 TOR_DNS_PORT="5353"
+TOR_TRANS_PORT="9040"
 TOR_NUM_GUARDS="3"
 TOR_SAFE_LOGGING="1"
 
@@ -36,14 +37,14 @@ MAC_VENDOR_SPOOF=""
 
 # ─── HOSTNAME ──────────────────────────────────────────────────────────────────
 # Pattern: desktop | random | custom
-HOSTNAME_PATTERN="desktop"
-HOSTNAME_CUSTOM_PREFIX=""
+HOSTNAME_PATTERN="random"
+HOSTNAME_CUSTOM_PREFIX="workstation"
 
 # ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
 HARDEN_IPV6="1"
 HARDEN_SWAP="1"
 HARDEN_CORE_DUMPS="1"
-HARDEN_CLIPBOARD_CLEAR="0"
+HARDEN_CLIPBOARD_CLEAR="1"
 HARDEN_SCREEN_LOCK="1"
 HARDEN_SCREEN_LOCK_TIMEOUT="300"
 HARDEN_TIMEZONE_SPOOF="0"
@@ -53,10 +54,10 @@ HARDEN_LOCALE_VALUE="en_US.UTF-8"
 
 # ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
 LEAK_WEBRTC_BLOCK="1"
-LEAK_USB_BLOCK="0"
+LEAK_USB_BLOCK="1"
 
 # ─── MONITORING ────────────────────────────────────────────────────────────────
-MONITOR_PROCESSES="0"
+MONITOR_PROCESSES="1"
 MONITOR_LOG_ROTATION="1"
 LOG_ROTATION_HOURS="4"
 
@@ -85,12 +86,12 @@ WIPE_METHOD="auto"
 
 # ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
 # Level: bare-metal-standard | bare-metal-paranoid | cloud-normal | cloud-paranoid
-DEPLOYMENT_LEVEL="bare-metal-standard"
+DEPLOYMENT_LEVEL="bare-metal"
 
 # ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
 # Mode: compact | full | auto | off
-OPSEC_BANNER="compact"
+OPSEC_BANNER="full"
 
 # ─── WIDGET THEME ────────────────────────────────────────────────────────────
 # Theme: default | aurora | ember | slate | cyberpunk | frost | terminal
-WIDGET_THEME="default"
+WIDGET_THEME="apt"