H-005 Provision Lightsail and host hardening

[dashprotocol]

Scope: VM, firewall, user hardening, updates. AC: only needed ports open; provisioning documented. Deploy gate: D0.