Run op CLI on controller and silence secret output

The target host does not have the op CLI installed, so op invocations
must run on the Semaphore controller (delegate_to: localhost, become:
false — the controller runs rootless). Generated/loaded secrets also
leak into task logs on failure, so mark the three op tasks and the
set_fact tasks with no_log: true.

playbooks/n8n.yml

@@ -25,6 +25,9 @@
       failed_when: false
       changed_when: false
       check_mode: no
+      delegate_to: localhost
+      become: false
+      no_log: true
       environment:
         OP_SERVICE_ACCOUNT_TOKEN: "{{ lookup('env','OP_SERVICE_ACCOUNT_TOKEN') }}"
 
@@ -35,11 +38,15 @@
         op item get "{{ stack_name }}" --vault="Automation" --format json
       register: op_item
       check_mode: no
+      delegate_to: localhost
+      become: false
+      no_log: true
       environment:
         OP_SERVICE_ACCOUNT_TOKEN: "{{ lookup('env','OP_SERVICE_ACCOUNT_TOKEN') }}"
 
     - name: Set secrets from 1Password
       when: op_check.rc == 0
+      no_log: true
       set_fact:
         n8n_postgres_password: "{{ (op_item.stdout | from_json).fields | selectattr('label','equalto','postgres_password') | map(attribute='value') | first }}"
         n8n_encryption_key: "{{ (op_item.stdout | from_json).fields | selectattr('label','equalto','encryption_key') | map(attribute='value') | first }}"
@@ -47,17 +54,22 @@
     # 🔑 Generate if new
     - name: Generate postgres password
       when: op_check.rc != 0
+      no_log: true
       set_fact:
         n8n_postgres_password: "{{ lookup('password','/dev/null length=32 chars=ascii_letters') }}"
 
     - name: Generate encryption key
       when: op_check.rc != 0
+      no_log: true
       set_fact:
         n8n_encryption_key: "{{ lookup('password','/dev/null length=64 chars=hexdigits') }}"
 
     # 📦 Store in 1Password
     - name: Create 1Password item
       when: op_check.rc != 0
+      delegate_to: localhost
+      become: false
+      no_log: true
       shell: |
         op item create \
           --category="Server" \