Add service accounts and systemd hardening

- cloudflared: create dedicated service account, run as non-root with
  ProtectSystem=strict and full hardening directives
- cloudflared: skip credentials overwrite when existing tunnel has valid
  credentials on disk; delete and recreate if credentials are missing
- wireguard: add systemd drop-in with ProtectHome, ProtectClock,
  ProtectHostname, ProtectKernelLogs, PrivateTmp

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/vpn/tasks/configure.yml

@@ -116,6 +116,28 @@
   args:
     creates: /etc/wireguard/clients/client1.conf
 
+- name: Create WireGuard systemd override directory
+  file:
+    path: /etc/systemd/system/wg-quick@wg0.service.d
+    state: directory
+    mode: "0755"
+
+- name: Deploy WireGuard systemd hardening override
+  copy:
+    dest: /etc/systemd/system/wg-quick@wg0.service.d/hardening.conf
+    content: |
+      [Service]
+      ProtectHome=true
+      ProtectClock=true
+      ProtectHostname=true
+      ProtectKernelLogs=true
+      PrivateTmp=true
+    mode: "0644"
+
+- name: Reload systemd daemon
+  systemd:
+    daemon_reload: true
+
 - name: Enable and start WireGuard
   systemd:
     name: wg-quick@wg0