feat(labelprint): 4x6 label print proxy on a Raspberry Pi

A Pi 3B+ (stickah.local) shares a Phomemo PM246 to the LAN as a plain CUPS
queue, so any machine can print 4x6 labels -- fulfillr-site's shipping labels
in particular -- without installing the vendor driver, which is x86-64 only.
The role builds the TSPL CUPS driver from source instead.

It is Debian, not Fedora, so it lives in its own inventory and playbook
(make deploy-labelprint / check-labelprint) and the home.debyl.io roles can
never run against it. make bootfs renders its cloud-init first-boot files onto
a freshly imaged SD card from the same templates the role uses. The Wi-Fi
credentials for the home and rescue networks are in the vault.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -14,6 +14,8 @@ This is a home infrastructure deployment repository using Ansible for automated
 - `make deploy TAGS=sometag` - Deploy only specific tagged tasks
 - `make deploy TARGET=specific-host` - Deploy to specific host instead of all
 - `make check` - Run deployment in dry-run mode showing potential changes
+- `make deploy-labelprint` / `make check-labelprint` - Deploy (or dry-run) the label print proxy Pi. Separate inventory and playbook from the home server - see `ansible/roles/labelprint/README.md`
+- `make bootfs BOOTFS=/Volumes/bootfs` - Render the label print proxy's cloud-init first-boot files onto a freshly imaged SD card
 - `make vault` - Edit encrypted Ansible vault file
 - `make list-tags` - List all available Ansible tags
 - `make list-tasks` - List all Ansible tasks
@@ -33,13 +35,16 @@ The project uses Python virtualenv for dependency management:
 ansible/
 ├── deploy.yml          # Main playbook entry point (imports deploy_home.yml)
 ├── deploy_home.yml     # Core playbook with role definitions
+├── deploy_labelprint.yml  # Label print proxy Pi (separate host, Debian)
 ├── inventories/home/   # Inventory configuration
+├── inventories/labelprint/  # Label print proxy inventory
 ├── roles/              # Ansible roles organized by function
 │   ├── common/        # Base system configuration
 │   ├── git/           # Git repository management
 │   ├── podman/        # Container orchestration
 │   ├── ssl/           # Legacy SSL management (deprecated - Caddy handles certificates automatically)
 │   ├── github-actions/# CI/CD runner setup
+│   ├── labelprint/    # 4x6 label print proxy (Raspberry Pi, CUPS/TSPL)
 │   └── pihole/        # DNS filtering
 └── vars/
     └── vault.yml      # Encrypted secrets
@@ -96,13 +101,27 @@ Tasks are tagged by service/component for selective deployment:
 
 ## Target Environment
 
-- Single target host: `home.debyl.io`
+- Primary target host: `home.debyl.io`
 - OS: Fedora (ansible_user: fedora)
 - Container runtime: Podman
 - Web server: Caddy with automatic HTTPS and built-in security (replaced nginx + ModSecurity)
 - All services accessible via HTTPS with automatic certificate renewal
 - ~~CI/CD: Drone CI infrastructure completely decommissioned~~
 
+### Label print proxy
+
+- Second target host: `stickah.local` (Raspberry Pi 3B+, Raspberry Pi OS 64-bit,
+  apt not dnf) with a Phomemo PM246 4x6 label printer on USB
+- Deployed only via `make deploy-labelprint` - it is in its own inventory so the
+  Fedora roles can never run against it
+- The SD card image is written by hand with rpi-imager, but its cloud-init files
+  come from `make bootfs`, rendered from the same templates the role uses
+- Login is `stickah` / `stickah` with SSH key auth preferred; password auth is a
+  deliberate LAN-only fallback so the box is never unreachable
+- LAN-only (192.168.1.0/24), discovered over mDNS, no DNS record
+- Falls back to its own rescue Wi-Fi AP at 192.168.4.1 when the home SSID is
+  unreachable
+
 ### Remote SSH Commands for Service Users
 
 The `podman` user (and other service users) have `/bin/nologin` as their shell. To run commands as these users via SSH: