Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/providers/aws.yml

@@ -7,10 +7,11 @@
   connection: local
   gather_facts: false
   vars:
+    deploy_id: "{{ deployment_id }}"
     aws_region: "{{ region | default('us-east-1') }}"
     ec2_instance_type: "{{ instance_type | default('t3.micro') }}"
     ec2_ami: "{{ ami | default('') }}"
-    ec2_key_name: "phantom-{{ deploy_id }}"
+    ec2_key_name: "ph-{{ deployment_id }}"
     ssh_key_path: "{{ ssh_key }}.pub"
 
   environment:
@@ -48,7 +49,7 @@
 
     - name: Create security group
       amazon.aws.ec2_security_group:
-        name: "phantom-{{ deploy_id }}"
+        name: "ph-{{ deploy_id }}"
         description: "phantom deployment {{ deploy_id }}"
         region: "{{ aws_region }}"
         rules:
@@ -68,7 +69,7 @@
 
     - name: Launch EC2 instance
       amazon.aws.ec2_instance:
-        name: "phantom-{{ deploy_id }}"
+        name: "ph-{{ deploy_id }}"
         key_name: "{{ ec2_key_name }}"
         instance_type: "{{ ec2_instance_type }}"
         image_id: "{{ ec2_ami }}"
@@ -97,6 +98,12 @@
         dest: "{{ _host_output_file }}"
       when: _host_output_file is defined
 
+    - name: Write instance ID for teardown
+      copy:
+        content: "{{ ec2_result.instances[0].instance_id }}"
+        dest: "{{ _host_output_file | dirname }}/instance_id"
+      when: _host_output_file is defined
+
     - name: Wait for SSH
       wait_for:
         host: "{{ target_host }}"