Refactor Ansible playbooks to comply with best practices and fix linting violations

- Implement 4-role architecture (base_provision, patching, hardening, decommission)
- Extract hardcoded values to role defaults and group_vars
- Add Ansible Vault integration for secrets management
- Implement proper handlers for service restarts instead of direct tasks
- Add Molecule testing framework with Docker driver
- Configure ansible-lint with production profile settings

Fix all 125+ ansible-lint violations:
- Add FQCN (Fully Qualified Collection Names) to all modules
- Replace yes/no with true/false for boolean values
- Add explicit mode parameters to file/template operations
- Remove duplicate post_tasks blocks from playbooks
- Add newlines at end of all YAML files
- Fix key ordering in tasks (name, when, block)
- Convert service restarts to handlers with notify
- Remove ignore_errors in favor of failed_when/changed_when
- Fix line length violations and empty lines
- Add noqa comments for unavoidable risky-file-permissions

Update documentation:
- Add REFACTORING.md with implementation details
- Add VAULT_GUIDE.md for secrets management
- Add per-role README.md files
- Update existing documentation

All playbooks now pass ansible-lint production profile with 0 violations.

enterprise-infra-simulator/roles/decommission/README.md

@@ -0,0 +1,62 @@
+# Decommission Role
+
+Gracefully decommission enterprise infrastructure nodes with comprehensive backup and cleanup.
+
+## Features
+
+- **Confirmation Prompt**: Interactive confirmation before decommissioning
+- **Graceful Shutdown**: Stop services gracefully with connection drain time
+- **Comprehensive Backup**: Archive configurations and data before cleanup
+- **Selective Cleanup**: Only remove items that were deployed
+- **Logging**: Detailed decommissioning logs for audit trail
+- **Notifications**: Optional email notifications on completion
+
+## Role Variables
+
+See `defaults/main.yml` for all available variables.
+
+### Key Variables
+
+- `backup_data`: Backup application data (default: true)
+- `export_config`: Export system configuration (default: true)
+- `graceful_shutdown`: Graceful service shutdown (default: true)
+- `auto_shutdown`: Auto shutdown after decommissioning (default: false)
+- `application_services`: Services to stop
+- `application_packages`: Packages to remove
+- `decommission_notification_email`: Email for notifications (optional)
+
+## Usage
+
+```yaml
+- role: decommission
+  vars:
+    backup_data: true
+    export_config: true
+    auto_shutdown: false
+    decommission_notification_email: "ops@company.com"
+```
+
+## Backup Locations
+
+- Configuration: `/var/backups/decommission-<timestamp>/config/`
+- Data: `/var/backups/decommission-<timestamp>/data/`
+- Report: `/var/log/decommission_report_<timestamp>.log`
+
+## Supported Groups
+
+- `webservers`: Backs up /var/www/html
+- `databases`: Backs up PostgreSQL data
+- `monitoring`: Backs up Prometheus data
+- `loadbalancers`: Loadbalancer cleanup
+
+## Safety Features
+
+- Interactive confirmation before execution
+- Connection drain time before shutdown (30 seconds)
+- Errors are logged but don't stop the process
+- Comprehensive audit log
+
+## Tags
+
+- `decommission`: All decommissioning tasks
+- `cleanup`: Cleanup-related tasks