[codex] Add Oathkeeper proxy for a11yvillage server

[AnsonShie]

Summary

• Add Oathkeeper config and access-rule generation to the a11yvillage-server Ansible playbook.
• Route Traefik traffic through the new a11yvillage-oathkeeper service instead of directly to the Django container.
• Add OATHKEEPER_SHARED_SECRET to the generated .env, using the AWS secret value when present and falling back to SECRET_KEY.

Impact

Deploying a11yvillage-server now produces the same Oathkeeper proxy topology as the reference a11yvillage-server compose setup while leaving the other Ansible playbooks unchanged.

Validation

• Parsed ansible_yaml/a11yvillage-server-playbook.yml with Ruby YAML.
• Parsed the generated Oathkeeper config, access rules, and docker-compose embedded YAML after substituting representative prod values.

Note: local ansible-playbook --syntax-check could not be run because ansible-playbook is not installed in this environment.