Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/providers/linode.yml

@@ -7,11 +7,12 @@
   connection: local
   gather_facts: false
   vars:
+    deploy_id: "{{ deployment_id }}"
     linode_token: "{{ api_token }}"
     linode_region: "{{ region | default('us-east') }}"
     linode_plan: "{{ plan | default('g6-nanode-1') }}"
     linode_image: "{{ image | default('linode/debian12') }}"
-    linode_label: "phantom-{{ deploy_id }}"
+    linode_label: "ph-{{ deployment_id }}"
     ssh_key_path: "{{ ssh_key }}.pub"
 
   tasks:
@@ -20,6 +21,10 @@
         src: "{{ ssh_key_path }}"
       register: ssh_pubkey
 
+    - name: Generate root password (required by API, SSH key auth used instead)
+      command: openssl rand -base64 32
+      register: root_pass_gen
+
     - name: Create Linode instance
       uri:
         url: https://api.linode.com/v4/linode/instances
@@ -33,6 +38,7 @@
           region: "{{ linode_region }}"
           image: "{{ linode_image }}"
           label: "{{ linode_label }}"
+          root_pass: "{{ root_pass_gen.stdout }}"
           authorized_keys:
             - "{{ ssh_pubkey.content | b64decode | trim }}"
           booted: true
@@ -58,6 +64,12 @@
         dest: "{{ _host_output_file }}"
       when: _host_output_file is defined
 
+    - name: Write instance ID for teardown
+      copy:
+        content: "{{ linode_result.json.id }}"
+        dest: "{{ _host_output_file | dirname }}/instance_id"
+      when: _host_output_file is defined
+
     - name: Wait for SSH
       wait_for:
         host: "{{ target_host }}"