Add pre-commit hooks for code quality (#19)

## Summary
- Add pre-commit framework with hooks for YAML, Ansible, Python, shell, TOML, JSON, and secret detection
- Fix all 91+ ansible-lint violations (variable naming, handler capitalization, changed_when)
- Fix shellcheck warnings in mise-tasks scripts
- Document pre-commit setup in README.md

## Deployment and Testing
- [x] All pre-commit hooks pass (`uvx pre-commit run --all-files`)
- [x] Test ansible playbook with `--check` mode
- [x] Run `mise run indri-services-check` after deploy

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/19

ansible/roles/tailscale_serve/tasks/main.yml

@@ -1,23 +1,24 @@
 ---
 - name: Get current tailscale serve status
   ansible.builtin.command: tailscale serve status --json
-  register: serve_status
+  register: tailscale_serve_status
   changed_when: false
 
 - name: Parse serve status
   ansible.builtin.set_fact:
-    serve_config: "{{ ((serve_status.stdout | default('{}', true)) | from_json).Services | default({}) }}"
+    tailscale_serve_config: "{{ ((tailscale_serve_status.stdout | default('{}', true)) | from_json).Services | default({}) }}"
 
 # Configure HTTPS if service doesn't have Web config yet
 - name: Configure HTTPS services
   ansible.builtin.command: >
     tailscale serve --service="{{ item.name }}"
     --https={{ item.https.port }} {{ item.https.upstream }}
-  loop: "{{ tailscale_services }}"
+  loop: "{{ tailscale_serve_services }}"
   when:
     - item.https is defined
-    - serve_config[item.name] is not defined or serve_config[item.name].Web is not defined
-  register: https_result
+    - tailscale_serve_config[item.name] is not defined or tailscale_serve_config[item.name].Web is not defined
+  register: tailscale_serve_https_result
+  changed_when: true
   failed_when: false
 
 # Configure TCP if service doesn't have the specific port configured yet
@@ -25,12 +26,13 @@
   ansible.builtin.command: >
     tailscale serve --service="{{ item.name }}"
     --tcp={{ item.tcp.port }} {{ item.tcp.upstream }}
-  loop: "{{ tailscale_services }}"
+  loop: "{{ tailscale_serve_services }}"
   when:
     - item.tcp is defined
-    - serve_config[item.name] is not defined or
-      serve_config[item.name].TCP is not defined or
-      serve_config[item.name].TCP[item.tcp.port | string] is not defined or
-      serve_config[item.name].TCP[item.tcp.port | string].TCPForward is not defined
-  register: tcp_result
+    - tailscale_serve_config[item.name] is not defined or
+      tailscale_serve_config[item.name].TCP is not defined or
+      tailscale_serve_config[item.name].TCP[item.tcp.port | string] is not defined or
+      tailscale_serve_config[item.name].TCP[item.tcp.port | string].TCPForward is not defined
+  register: tailscale_serve_tcp_result
+  changed_when: true
   failed_when: false