initial scaffold: Meridian LXC (Node 22 + npm @rynfar/meridian + systemd)

Deploys @rynfar/meridian on a Debian 12 LXC, bound to 0.0.0.0:3456.
OAuth credentials transferred manually after first deploy (claude login on
Mac, scp ~/.claude to /opt/meridian/.claude). systemd unit is enabled but
gated on credentials.json existence so the first deploy doesn't crash-loop.

LXC has no auth layer — security model is LAN-only reachability.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

roles/meridian/templates/meridian.service.j2

@@ -0,0 +1,23 @@
+[Unit]
+Description=Meridian (Anthropic API → Claude Code SDK bridge)
+Documentation=https://github.com/rynfar/meridian
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User={{ meridian_user }}
+Group={{ meridian_user }}
+WorkingDirectory={{ meridian_home }}
+Environment=HOME={{ meridian_home }}
+Environment=MERIDIAN_HOST={{ meridian_host }}
+Environment=MERIDIAN_PORT={{ meridian_port }}
+Environment=MERIDIAN_IDLE_TIMEOUT_SECONDS={{ meridian_idle_timeout_seconds }}
+ExecStart={{ meridian_bin.stdout }}
+Restart=on-failure
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target