inventory: add ubongo to control group; set ssh-from-control addr

Wire the now-built physical control node ubongo (10.20.10.151) into the
production control group (the documented manual exception), and activate the
dormant base__firewall_control_addr knob (ADR-021 ssh-from-control source).
Forward-wiring only: no host has the base role applied yet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

inventories/production/group_vars/all/vars.yml

@@ -36,3 +36,6 @@ services__base_dir: /opt/services
 
 # Unattended upgrades — security patches only
 base__unattended_upgrades_enabled: true
+
+# Management plane — activates the dormant ssh-from-control firewall rule
+base__firewall_control_addr: "10.20.10.151"  # ubongo (control node) LAN address — ADR-021 ssh-from-control source

inventories/production/hosts.yml

@@ -7,7 +7,9 @@
 all:
   children:
     control:
-      hosts: {}
+      hosts:
+        ubongo:
+          ansible_host: 10.20.10.151
     docker_hosts:
       hosts: {}
     proxmox_hosts: