chore(deploy): rewrite ansible for motief on motief.sgeboers.nl, remove drone

- Replace gtfs/bokeh deploy with motief/streamlit (port 8501)
- Update inventory to motief.sgeboers.nl
- Remove stale .drone.yml
- Add CI guard to forbid .env in repo
- Add env removal report and secrets rotation checklist

ansible/deploy.yaml

@@ -1,26 +1,26 @@
 ---
-- name: deploy gtfs application
-  hosts: sgeboers.nl
+- name: deploy motief application
+  hosts: motief.sgeboers.nl
   remote_user: webapps
 
   tasks:
-    - name: make directories
+    - name: pull latest code
       ansible.builtin.git:
-        repo: https://git.sgeboers.nl/sgeboers/gtfs.git
-        dest: ~/gtfs/code
+        repo: git@git.sgeboers.nl:sgeboers/motief.git
+        dest: ~/motief
         clone: yes
         force: yes
-    - name: install virtualenv
-      ansible.builtin.pip:
-        name: virtualenv
-        executable: pip3
-    - name: install correct packages
-      ansible.builtin.pip:
-        requirements: ~/gtfs/code/requirements.txt
-        virtualenv: ~/gtfs/env
-    - name: stop old script
+
+    - name: sync dependencies with uv
       ansible.builtin.shell:
-        cmd: kill $(ps aux | grep "bokeh serve" | grep -v grep | awk '{print $2}') || true
-    - name: start script
+        cmd: uv sync
+        chdir: ~/motief
+
+    - name: stop existing streamlit process
       ansible.builtin.shell:
-        cmd: . ~/gtfs/env/bin/activate; cd ~/gtfs/code; nohup bokeh serve main.py --allow-websocket-origin=sgeboers.nl:5006 --allow-websocket-origin=gtfs.sgeboers.nl &
+        cmd: pkill -f "streamlit run Home.py" || true
+
+    - name: start streamlit
+      ansible.builtin.shell:
+        cmd: nohup uv run streamlit run Home.py --server.port=8501 --server.address=0.0.0.0 &
+        chdir: ~/motief

ansible/inventory.ini

@@ -1 +1 @@
-sgeboers.nl
+motief.sgeboers.nl