ansible: run Xray on asxpio-services

The VLESS Reality proxy ran from a hand-installed binary on the
temporary server. Run the upstream image instead, pinned and on the
host network, with only CAP_NET_BIND_SERVICE; its config (keys and
client id) is in the vault.

Assisted-by: Claude:opus-5-5

ansible/roles/xray/templates/docker-compose.yml.j2

@@ -0,0 +1,16 @@
+# Managed by Ansible (role xray). Root in the container only to read the
+# 0600 config and bind :443; every other capability is dropped.
+services:
+  xray:
+    image: ghcr.io/xtls/xray-core:{{ xray_version }}
+    container_name: xray
+    command: ["run", "-c", "/etc/xray/config.json"]
+    network_mode: host
+    user: "0"
+    cap_drop: [ALL]
+    cap_add: [NET_BIND_SERVICE]
+    security_opt: ["no-new-privileges:true"]
+    read_only: true
+    volumes:
+      - ./config.json:/etc/xray/config.json:ro
+    restart: unless-stopped