feat(labelprint): 4x6 label print proxy on a Raspberry Pi

A Pi 3B+ (stickah.local) shares a Phomemo PM246 to the LAN as a plain CUPS
queue, so any machine can print 4x6 labels -- fulfillr-site's shipping labels
in particular -- without installing the vendor driver, which is x86-64 only.
The role builds the TSPL CUPS driver from source instead.

It is Debian, not Fedora, so it lives in its own inventory and playbook
(make deploy-labelprint / check-labelprint) and the home.debyl.io roles can
never run against it. make bootfs renders its cloud-init first-boot files onto
a freshly imaged SD card from the same templates the role uses. The Wi-Fi
credentials for the home and rescue networks are in the vault.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/labelprint/templates/rescue-ap.nmconnection.j2

@@ -0,0 +1,38 @@
+# {{ ansible_managed }}
+#
+# Rescue access point. Never autoconnects -- wifi-rescue brings it up only when
+# the home SSID is unreachable, so that a changed password or a dead router
+# leaves a way back in to reconfigure the Pi.
+#
+# Join this SSID and the Pi is at {{ labelprint_ap_addr }}: ssh pi@{{ labelprint_ap_addr }},
+# or print to it directly at ipp://{{ labelprint_ap_addr }}:631/printers/{{ labelprint_queue }}.
+[connection]
+id=rescue-ap
+uuid={{ (stickah_ssid_rescue ~ '-rescue-ap') | to_uuid }}
+type=wifi
+interface-name=wlan0
+autoconnect=false
+
+[wifi]
+mode=ap
+ssid={{ stickah_ssid_rescue }}
+# The 3B+ radio does 5 GHz, but 2.4 GHz AP mode is what brcmfmac is reliable
+# at, and a rescue network only has to carry an SSH session.
+band=bg
+channel=6
+
+[wifi-security]
+key-mgmt=wpa-psk
+proto=rsn
+pairwise=ccmp
+group=ccmp
+psk={{ stickah_psk_rescue }}
+
+# "shared" makes NetworkManager run a dnsmasq for DHCP and DNS on this
+# interface, so a laptop that joins gets an address without any further setup.
+[ipv4]
+method=shared
+address1={{ labelprint_ap_addr }}/24
+
+[ipv6]
+method=ignore