Add storage_box playbook and fix HCLOUD_TOKEN extraction

- Add storage_box role: generates SSH key pair, creates Hetzner Storage
  Box with known password, installs public key via install-ssh-key,
  writes storagebox.yml to stack config. Idempotent: skips key install
  if SSH key auth already works.
- Add deploy.yml: one-shot playbook chaining provision → dns →
  storage_box → bootstrap → site for fresh deployments
- Fix .envrc HCLOUD_TOKEN extraction stripping surrounding quotes from
  vault YAML values
- Add restic_storagebox_password to vault template and setup.sh prompt
- Add sshpass to README prerequisites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

roles/restic/tasks/backend_sftp.yml

@@ -1,8 +1,8 @@
 ---
 - name: Deploy Restic SSH key
   ansible.builtin.copy:
-    src: restic_backup         # local path in your playbook repo
-    dest: "{{ restic_ssh_key }}"    # e.g. /root/.ssh/restic_backup
+    src: "{{ restic_local_key_path }}"
+    dest: "{{ restic_ssh_key }}"
     owner: root
     group: root
     mode: '0600'