Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/README.md

@@ -8,12 +8,12 @@ Deploy self-hosted privacy infrastructure with a single command. Supports cloud
 |---|---|---|
 | Matrix + Element | Ready | Encrypted messaging homeserver with web client |
 | WireGuard VPN | Ready | Private VPN server with client config generation |
-| Pi-hole DNS | Ready | Ad-blocking DNS server (Docker-based) |
+| Pi-hole DNS | Ready | Ad-blocking DNS server (native) |
+| Nextcloud | Ready | Self-hosted file sync and collaboration |
+| Vaultwarden | Ready | Self-hosted Bitwarden password manager |
+| Jellyfin | Ready | Self-hosted media server |
+| Mail-in-a-Box | Ready | Self-hosted email |
 | All-in-One | Ready | Multiple services on one server with nginx reverse proxy |
-| Nextcloud | Stub | Self-hosted file sync and collaboration |
-| Vaultwarden | Stub | Self-hosted Bitwarden password manager |
-| Jellyfin | Stub | Self-hosted media server |
-| Mail-in-a-Box | Stub | Self-hosted email |
 
 ## Deployment Targets
 
@@ -87,6 +87,10 @@ phantom/
 │   ├── matrix/         # Synapse + Element
 │   ├── vpn/            # WireGuard
 │   ├── dns/            # Pi-hole
+│   ├── cloud/          # Nextcloud
+│   ├── vault/          # Vaultwarden
+│   ├── media/          # Jellyfin
+│   ├── email/          # Mail-in-a-Box
 │   └── all_in_one/     # Multi-service composer
 ├── providers/          # Cloud provisioning
 └── logs/               # Deployment artifacts