Add deliberate update playbook and unattended-upgrades role

Regular playbooks now use state: present, so they no longer upgrade
packages as a side effect. This adds two separate, explicit mechanisms
to keep the fleet patched instead:

- update-packages.yml: ad hoc / to-be-scheduled fleet-wide upgrade
  (safe by default, dist available via -e), plus
  update-packages-pinned-example.yml as a template for pinning or
  bumping a single package outside that.
- roles/unattended_upgrades: automatic security-only patching via
  unattended-upgrades, with a scheduled reboot window and mail
  left disabled pending a configured MTA. Applied to every host in
  full.yml and server.yml.

Also removes a leftover `upgrade: yes` apt task from pi_standard_setup
and server_basic_environment that was still doing a full upgrade on
every routine run, defeating the point of the state: present switch.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

roles/unattended_upgrades/templates/20auto-upgrades.j2

@@ -0,0 +1,7 @@
+// Managed by Ansible (roles/unattended_upgrades) — changes will be overwritten.
+
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";
+APT::Periodic::Verbose "1";

roles/unattended_upgrades/templates/50unattended-upgrades.j2

@@ -0,0 +1,29 @@
+// Managed by Ansible (roles/unattended_upgrades) — changes will be overwritten.
+
+Unattended-Upgrade::Origins-Pattern {
+{% if unattended_upgrades_security_only %}
+        "origin=${distro_id},codename=${distro_codename},label=${distro_id}-Security";
+        "origin=${distro_id},codename=${distro_codename}-security,label=${distro_id}-Security";
+        "origin=Debian,codename=${distro_codename},label=Debian-Security";
+        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+{% else %}
+        "origin=${distro_id},codename=${distro_codename}";
+        "origin=${distro_id},codename=${distro_codename}-security";
+        "origin=${distro_id},codename=${distro_codename}-updates";
+{% endif %}
+{% for origin in unattended_upgrades_origins_extra %}
+        "{{ origin }}";
+{% endfor %}
+};
+
+Unattended-Upgrade::Remove-Unused-Dependencies "{{ unattended_upgrades_remove_unused_deps | lower }}";
+
+Unattended-Upgrade::Automatic-Reboot "{{ unattended_upgrades_auto_reboot | lower }}";
+Unattended-Upgrade::Automatic-Reboot-Time "{{ unattended_upgrades_auto_reboot_time }}";
+
+Unattended-Upgrade::SyslogEnable "true";
+
+{% if unattended_upgrades_mail_to %}
+Unattended-Upgrade::Mail "{{ unattended_upgrades_mail_to }}";
+Unattended-Upgrade::MailOnlyOnError "{{ unattended_upgrades_mail_on_only_error | lower }}";
+{% endif %}