refactor(ansible): move RouterOS config into a role

Move flat tasks/ and vars/routeros-secrets.yml into
roles/routeros/ with a main.yml that imports the domain
task files in order. Update playbooks/routeros.yml to
use the role instead of importing tasks directly.

ansible/roles/routeros/vars/main.yml

@@ -0,0 +1,19 @@
+---
+# Secret references only; actual values are loaded from OpenBao/Vault at runtime.
+
+# KVv2 mount and secret path (full secret path is <mount>/data/<path>).
+openbao_kv_mount: secret
+
+# Field names expected in the OpenBao secret.
+openbao_fields:
+  routeros_api:
+    path: routeros_api
+    username_key: username
+    password_key: password
+  wan_pppoe:
+    path: wan_pppoe
+    username_key: username
+    password_key: password
+  routeros_tailscale_container:
+    path: router_tailscale
+    container_password_key: container_password