Document the no-$-in-vault-values rule that caused the MQTT auth failure

A password containing "$fP" was interpolated away by compose, giving
mosquitto and c2-core two different passwords and producing
"MQTT connect refused: Not authorized" with nothing in the logs pointing at
the cause. Recorded next to the values so the next person generating
credentials sees it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

infra/ansible/vault.yml.example

@@ -4,6 +4,13 @@
 # Edit later with:
 #   ansible-vault edit vault.yml
 
+# DO NOT put a literal "$" in any value here. Docker compose interpolates the
+# top-level .env, and depending on version it also interpolates env_file, so a
+# password like "aB$fPx" is read as the variable $fPx and silently replaced
+# with an empty string — on one side of the connection but not the other.
+# That produced "MQTT connect refused: Not authorized" with no obvious cause.
+# Generate with: openssl rand -hex 32  (hex output has no shell metacharacters)
+
 # ── MQTT ─────────────────────────────────────────────────────────────────────
 vault_mqtt_c2_user: drb-c2-core
 vault_mqtt_c2_pass: "CHANGE_ME"