Add web setup UI for first-boot config

- server.py: Flask-free Python web server on port 80
  - 4-step wizard: network → tier → tools → live install log
  - DHCP or static IP support
  - SSE log streaming, handles phase-1 reboot gracefully
- user-data: deploy web UI service instead of TUI (whiptail)
  - sets hostname to cezenai (accessible as cezenai.local)
  - installs python3, avahi-daemon
- entry.yml: skip roles based on skip_roles var from web UI
- install.sh: reads /opt/cezen/install.conf for tier & skip_roles

install.sh

@@ -9,13 +9,18 @@ set -e
 
 TIER="entry"
 PHASE="1"
+SKIP_ROLES=""
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ANSIBLE_DIR="$SCRIPT_DIR/ansible"
 
+# Load saved config (written by web setup UI before phase 1)
+[ -f /opt/cezen/install.conf ] && source /opt/cezen/install.conf
+
 for arg in "$@"; do
   case $arg in
     --tier=*)  TIER="${arg#*=}" ;;
     --phase=*) PHASE="${arg#*=}" ;;
+    --skip=*)  SKIP_ROLES="${arg#*=}" ;;
   esac
 done
 
@@ -101,9 +106,13 @@ run_phase2() {
     echo "✓ NVIDIA driver: $(nvidia-smi --query-gpu=driver_version --format=csv,noheader | head -1)"
   fi
 
+  # Build skip_roles extra var (comma-separated list, empty string = skip nothing)
+  EXTRA_VARS="tier=$TIER skip_roles=\"$SKIP_ROLES\""
+  echo "→ Tier: $TIER | Skip: ${SKIP_ROLES:-none}"
+
   ANSIBLE_STDOUT_CALLBACK=yaml \
   ansible-playbook -i localhost, -c local "$ANSIBLE_DIR/entry.yml" \
-    -e "tier=$TIER"
+    -e "$EXTRA_VARS"
 
   # Disable one-shot service so it doesn't run again on next reboot
   systemctl disable cezen-phase2.service 2>/dev/null || true