Used in team#41829

the comment at the top of the playbook section will hopefully help us to
remember to keep the playbook URLs in order if we rename the section.

the debian package from trixie just renamed the exporter's binary in
last night's package upgrade.

Adds information about new roles.

See merge request !72

I'm guessing that disabling the archiver after having it enabled is not
a common case, but with this we should be able to remember how to clear
out the alert.

refs: team#41655

refs: team#41655

Helped debug boot failures in team#41829

I'm not 100% certain about what to do in the case that the archive is
valid, so I indicated that maybe we want to extract it in a subdir. we
can adjust that when we find a case where that happens. today's case was
a corrupted archive that we could delete.

this is in addition to what we can find with `gnt-instance info`

I did the onboarding with gillian and things were not quite right. The
top NOTE was particularly confusing.

This has become a blocker for other teams to manage their buckets and
ACLs. I had created an account for hiro to manage her stuff, but it
blocked on her lacking access to the server to jump to the admin
interface (team#41873).

So widen access here: allow all admins to access the admin interface
directly (same as global SSH access), then also allow the jump hosts,
and provide a shim (in hiera) to add extra IP addresses just for
MinIO (currently unused).

@lelutin got confused by the admin/gitlab string, this should make it clearer.