Serve randomized decoy sites with robots.txt

[andre487]

Masked HTTPS routes now serve a static site through GOST's built-in loopback file server, including /robots.txt with Disallow: / and HTML noindex,nofollow. A standard-library Python script generates a random heading and abstract SVG once; repeated Ansible runs preserve the site. Knock and authenticated proxy traffic retain their existing behavior.

Verification uses public route metadata so route-specific masking is checked without logging chain credentials. Includes generation tests and regeneration instructions. One-time migration commands and private inventory are excluded.

Validation:

• 55 tests passed; Ruff, compilation, and all Ansible syntax checks passed.
• Applied to four masked hosts; verified pages, SVG, robots.txt on all chain domains, knock, and authenticated CONNECT. A repeated apply on px-ru made zero changes.
• All six chains passed exit-IP requests. Full verification remains limited by five unchanged direct exit proxies returning HTTP 407 with inventory user credentials.

Host provisioning now runs both Ubuntu 24.04 and Debian 12 two-host Jump on every PR and push, including main. Workflow YAML and event/job conditions were validated locally.

SSH configuration validation handlers now trigger their reload notifications after successful validation. A runnable Ansible regression test covers both admin and proxy handlers (56 local tests passed). The two-host CI test shares SSH identity/known-host settings with ProxyJump and no longer manually reloads SSH before testing, so unapplied configuration cannot be masked.