Baseline provisioning applied to every Pi: apt update/upgrade, detects the Pi model, adds a root SSH key, disables the SSH locale-forwarding warning, optionally configures wifi and the hostname, and rotates the default pi/raspberry credentials via the keepass lookup plugin.

Key vars: pi_standard_setup_wifi_ssid, pi_standard_setup_new_hostname, pi_standard_setup_timezone, pi_standard_setup_wifi_country, ansible_ssh_pass (the OS-default password, used only to reach a freshly-flashed Pi for the first time before its password is rotated)