feat: multi-role architecture, public release preparation

[findias]

Summary

Full refactor of the repository into separate Ansible roles with dual-server support (EU + RU VPS), plus preparation for public release.

New roles

• raven_subscribe — standalone subscription server deployment, decoupled from xray/sing-box. Supports per-inbound inbound_hosts/inbound_ports overrides so all VLESS protocols route through a single domain.
• nginx_frontend — TLS reverse proxy on EU VPS. Listens on port 8443 (port 443 reserved by Xray Reality). Adds nginx stream TCP passthrough on port 8445 → 127.0.0.1:443 for Reality clients.
• relay — nginx reverse proxy on RU VPS. TCP stream relay 8444 → EU:8445 routes VLESS Reality through the RU server. Serves a static stub site as camouflage.

xray role changes

• Removed raven_subscribe vars/tasks (moved to dedicated role)
• Fixed DNS query strategy UseIP → UseIPv4 to prevent IPv6 network is unreachable errors on servers without global IPv6

sing-box

• Updated hysteria2 default port 8443 → 8444 (8443 now used by nginx_frontend)

Public release preparation

• Rewrote README.md with full architecture diagrams, role reference, secrets docs, DNS setup, VLESS Encryption and Hysteria2 sections
• Added README.ru.md (Russian translation, full parity with EN)
• Added roles/hosts.yml.example (safe template, no real IPs/usernames)
• Replaced all personal domains with example.com in defaults, templates, inventory, and playbook comments
• Removed leftover draft files: roles/xray/exampl/ directory
• Removed unused roles/xray/tasks/raven_subscribe.yml

Architecture after this PR

EU VPS
  Xray        :443  — VLESS Reality + XHTTP
  nginx       :8443 — TLS proxy → Raven :8080 + Xray XHTTP :2053
  nginx stream:8445 — TCP relay → Xray :443
  Raven       :8080 — subscription server

RU VPS
  nginx       :443  — stub site + my.domain → EU:8443 (Raven)
  nginx stream:8444 — TCP relay → EU:8445 (Reality)

Test plan

• ./tests/run.sh passes (Ansible render + xray -test)
• Deploy role_xray.yml — Xray starts, inbounds on 443/2053
• Deploy role_nginx_frontend.yml — nginx on 8443, stream on 8445
• Deploy role_raven_subscribe.yml — subscription returns correct addresses
• Deploy role_relay.yml — relay proxies to EU correctly
• No personal data (IPs, domains, usernames) in any committed file