ansible: run Xray on asxpio-services

The VLESS Reality proxy ran from a hand-installed binary on the
temporary server. Run the upstream image instead, pinned and on the
host network, with only CAP_NET_BIND_SERVICE; its config (keys and
client id) is in the vault.

Assisted-by: Claude:opus-5-5

ansible/roles/xray/tasks/main.yaml

@@ -0,0 +1,11 @@
+---
+- name: Deploy Xray
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: xray
+    service_base_path: "{{ services_base_path }}/xray"
+    service_templates:
+      - { src: docker-compose.yml.j2, dest: docker-compose.yml }
+      - { src: config.json.j2, dest: config.json, mode: "0600" }
+    health_check_port: 443