ops(ansible): harden provisioning and restore automation

Fail before host changes when required deployment variables are missing.

Precreate the PostgreSQL temporary directory and escape Bash syntax during Jinja rendering.

ansible/playbooks/setup-node.yml

@@ -1,7 +1,22 @@
 ---
 - name: Configure todo nodes
   hosts: all
+  gather_facts: false
   become: true
+  pre_tasks:
+    - name: Validate required setup configuration
+      block:
+        - name: Assert required setup variables
+          ansible.builtin.assert:
+            that:
+              - app_db_password | default('', true) | length > 0
+              - wal_g_access_key | default('', true) | length > 0
+              - wal_g_secret_key | default('', true) | length > 0
+              - (deployment_environment | default('')) in ['prod', 'staging']
+              - (wal_g_s3_prefix | default('')) is match('^s3://.+/prod/?$')
+            fail_msg: "Required setup configuration is missing or invalid for {{ inventory_hostname }}."
+            quiet: true
+      any_errors_fatal: true
   roles:
     - common
     - postgres