Hardening a fresh Ubuntu 24.04 server with Ansible without locking yourself out

An Ansible order of operations for a new Ubuntu 24.04 VPS: users, ufw, key-only SSH, fail2ban, updates, sysctl, auditd, without cutting off your own access.