Implements Task 4 (the play was run on-site but never committed). Creates the
named admin user, imports the operator pubkey over SCP (net_put), enables SSH.
Improvements over the plan: the key import is :if [find] guarded so re-runs don't
create duplicate keys, and the vaulted password is loaded via vars_files (it is
not auto-loaded because group_vars/mikrotik.vault.yml doesn't match the group-name
convention). Verified idempotent (changed=0) against crs310-maker; no duplicate key.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
