feat(labelprint): 4x6 label print proxy on a Raspberry Pi

A Pi 3B+ (stickah.local) shares a Phomemo PM246 to the LAN as a plain CUPS
queue, so any machine can print 4x6 labels -- fulfillr-site's shipping labels
in particular -- without installing the vendor driver, which is x86-64 only.
The role builds the TSPL CUPS driver from source instead.

It is Debian, not Fedora, so it lives in its own inventory and playbook
(make deploy-labelprint / check-labelprint) and the home.debyl.io roles can
never run against it. make bootfs renders its cloud-init first-boot files onto
a freshly imaged SD card from the same templates the role uses. The Wi-Fi
credentials for the home and rescue networks are in the vault.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/labelprint/tasks/driver.yml

@@ -0,0 +1,147 @@
+---
+# Builds RunTheWall/tspl-cups-driver (MIT) from a pinned commit. The build is
+# three files -- a CUPS raster filter, a backend and a PPD -- so it is cheap to
+# do on the Pi itself and avoids trusting a prebuilt binary.
+- name: fetch the tspl driver source
+  become: true
+  ansible.builtin.git:
+    repo: "{{ labelprint_driver_repo }}"
+    dest: "{{ labelprint_driver_src }}"
+    version: "{{ labelprint_driver_version }}"
+    force: true
+  register: labelprint_driver_checkout
+  tags: [labelprint, driver]
+
+- name: check whether the filter is already built
+  become: true
+  ansible.builtin.stat:
+    path: /usr/lib/cups/filter/rastertotspl
+  register: labelprint_filter
+  tags: [labelprint, driver]
+
+# `make` alone is not idempotent enough to report honestly -- it prints a
+# recipe line on a rebuild and nothing on a no-op -- so the decision to build is
+# made from the checkout state instead.
+- name: build the tspl raster filter
+  become: true
+  community.general.make:
+    chdir: "{{ labelprint_driver_src }}"
+  when: labelprint_driver_checkout.changed or not labelprint_filter.stat.exists
+  tags: [labelprint, driver]
+
+- name: install the tspl raster filter
+  become: true
+  ansible.builtin.copy:
+    src: "{{ labelprint_driver_src }}/src/rastertotspl"
+    dest: /usr/lib/cups/filter/rastertotspl
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0755"
+  notify: restart cups
+  tags: [labelprint, driver]
+
+# 0700 and root-owned on purpose: cupsd refuses to run a backend that is group-
+# or world-writable, and runs it as an unprivileged user if it is not 0700.
+# Writing to the printer's usblp node needs the privileged path.
+- name: install the tspl backend
+  become: true
+  ansible.builtin.copy:
+    src: "{{ labelprint_driver_src }}/backend/tspl"
+    dest: /usr/lib/cups/backend/tspl
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0700"
+  notify: restart cups
+  tags: [labelprint, driver]
+
+- name: create the PPD directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ labelprint_ppd_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: [labelprint, driver]
+
+- name: install the tspl PPD
+  become: true
+  ansible.builtin.copy:
+    src: "{{ labelprint_driver_src }}/ppd/tspl-label.ppd"
+    dest: "{{ labelprint_ppd_dir }}/tspl-label.ppd"
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+  tags: [labelprint, driver]
+
+# ---------------------------------------------------------------------------
+# The 4x6-only PPD
+# ---------------------------------------------------------------------------
+# Regenerated from the driver's PPD every run rather than kept as a fork, so a
+# driver bump brings its new PPD through the same filter.
+- name: create the helper directory
+  become: true
+  ansible.builtin.file:
+    path: /usr/local/share/labelprint
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: labelprint_media_only_4x6
+  tags: [labelprint, driver]
+
+- name: install the PPD media trim filter
+  become: true
+  ansible.builtin.copy:
+    src: trim-ppd-media.awk
+    dest: /usr/local/share/labelprint/trim-ppd-media.awk
+    owner: root
+    group: root
+    mode: "0644"
+  when: labelprint_media_only_4x6
+  tags: [labelprint, driver]
+
+- name: render the 4x6-only PPD
+  become: true
+  ansible.builtin.command:
+    argv:
+      - awk
+      - -v
+      - "keep={{ labelprint_ppd_pagesize }}"
+      - -f
+      - /usr/local/share/labelprint/trim-ppd-media.awk
+      - "{{ labelprint_ppd_dir }}/tspl-label.ppd"
+  register: labelprint_ppd_trim
+  changed_when: false
+  when: labelprint_media_only_4x6
+  tags: [labelprint, driver]
+
+- name: install the 4x6-only PPD
+  become: true
+  ansible.builtin.copy:
+    content: "{{ labelprint_ppd_trim.stdout }}\n"
+    dest: "{{ labelprint_ppd_dir }}/tspl-label-4x6.ppd"
+    owner: root
+    group: root
+    mode: "0644"
+    validate: cupstestppd -q %s
+  when: labelprint_media_only_4x6
+  tags: [labelprint, driver]
+
+# Gives the printer a stable /dev/usb/tspl-label symlink across USB
+# re-enumeration. Harmless if the PM246's id is not in the shipped rules -- the
+# backend still finds it by walking /dev/usb/lp*.
+- name: install the tspl udev rules
+  become: true
+  ansible.builtin.copy:
+    src: "{{ labelprint_driver_src }}/udev/99-tspl-label.rules"
+    dest: /etc/udev/rules.d/99-tspl-label.rules
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload udev rules
+  tags: [labelprint, driver]