Add macOS development station playbook and role

- Created a new Ansible playbook for configuring macOS development stations.
- Added role `macos_dev_station` with default variables, handlers, and tasks.
- Implemented tasks for installing Homebrew packages, managing user configurations, and setting up launch agents for code-server and opencode.
- Included templates for launchd plist files and startup scripts for code-server and opencode.
- Added validation for required environment variables and configurations.
- Updated inventory to include macOS hosts and added a setup script for initial prerequisites.
- Modified Terraform configuration to include DNS records for new services.

Readme.MD

@@ -105,3 +105,48 @@ Create a python environment use:
 ```
 python -m venv .venv  --system-site-packages 
 ```
+
+# macOS Dev Station
+
+Use the repository hybrid flow: bootstrap once with shell script, then manage day-2 changes with Ansible.
+
+## 1) Bootstrap prerequisites on the Mac
+
+```
+./scripts/setup-dev-station.sh
+```
+
+This installs only prerequisites (Homebrew, base tools, Ansible) and avoids persistent shell side effects.
+
+## 2) Configure the Mac with Ansible
+
+1. Add or adjust the host in `inventory/hosts` under `[darwin_dev]`.
+2. Configure host vars in `ansible/host_vars/mac-01.lab.alexpires.me.yml`.
+3. Run:
+
+```
+cd ansible
+sectool exec ansible-playbook playbook_macos_dev_station.yml --limit darwin_dev
+```
+
+The macOS role configures tools, tmux, code-server and opencode as system launchd daemons running under a dedicated service user. This allows services to start at boot without requiring an interactive login.
+
+OpenCode server auth is injected from environment variables. Ensure `OPENCODE_SERVER_USERNAME` and `OPENCODE_SERVER_PASSWORD` are available through `ansible/sectool.env` values before running the playbook.
+code-server password auth is also env-backed. Ensure `CODE_SERVER_PASSWORD` is available through `ansible/sectool.env` values before running the playbook.
+Hard mode (system daemons + dedicated service user) also requires sudo rights. Use passwordless sudo for your ansible user or set `ANSIBLE_BECOME_PASSWORD` through `ansible/sectool.env` values before running the playbook.
+
+## 3) Optional DNS entry in dev-01 CoreDNS
+
+From `terraform/apps/dev-01`, you can inject an optional DNS record for the Mac dev station:
+
+```
+export TF_VAR_mac_dev_station_dns_name="mac-mini"
+export TF_VAR_mac_dev_station_dns_type="A"
+export TF_VAR_mac_dev_station_dns_target="10.19.4.250"
+
+sectool -f ../../../sectool.json exec tofu validate
+sectool -f ../../../sectool.json exec tofu plan
+sectool -f ../../../sectool.json exec tofu apply -auto-approve
+```
+
+Use `CNAME` + hostname target instead of `A` when you want an alias.