feat(server): carry shron's own configuration into the role file

Task 7 as planned would have checked out over shron and reviewed what was lost
afterwards. That is the wrong order for a machine whose .zshrc holds working
operational tooling: ipt-block, a CrowdSec whitelist helper, reboot_required,
the German locale and dircolors would all have been gone between the checkout
and the review.

Also found: shron runs ZSH_THEME="ys" and has no powerlevel10k. The theme
selection would have fallen through to oh-my-zsh's default, which is a
regression nobody asked for, so 05-pre-omz.zsh keeps ys where p10k is absent.
The red role colour is still set, but it is honest to say it does nothing there
until p10k is installed - the safeguard the role split was built around does
not currently apply to the one machine it was meant for.

05-prompt.zsh becomes 05-pre-omz.zsh: the theme was never the only thing that
has to precede oh-my-zsh. DISABLE_AUTO_UPDATE belongs there too - a server
should not go fetching updates on its own while somebody is logged in fixing
something - and the stub no longer sets the update mode itself.

update-blacklist is carried over with a note rather than silently: openbl.org
answers 301 and the curl call has no -L, so it has been reporting "Blacklist
download failed" for some time. CrowdSec covers that ground now, but the
iptables chain it created may still exist and is worth removing deliberately.

PYTHONPATH pointed at python3.4 on shron and at 3.9 on beastix. Neither
directory exists; neither is carried over.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.zshrc

@@ -41,12 +41,10 @@ for _p in $_want_plugins; do
 done
 unset _p _want_plugins
 
-zstyle ':omz:update' mode auto
-
-# Also before oh-my-zsh: it loads the theme while sourcing, and powerlevel10k
-# reads its settings when it loads. Putting either in the role file - which is
-# sourced afterwards - leaves the value set and the theme unloaded.
-[[ -r "$HOME/.config/zsh/rc.d/05-prompt.zsh" ]] && source "$HOME/.config/zsh/rc.d/05-prompt.zsh"
+# Theme and oh-my-zsh's own settings, which it reads while being sourced.
+# Anything of that kind placed in a role file - which comes afterwards - is
+# silently ignored, so it lives here instead.
+[[ -r "$HOME/.config/zsh/rc.d/05-pre-omz.zsh" ]] && source "$HOME/.config/zsh/rc.d/05-pre-omz.zsh"
 
 source "$ZSH/oh-my-zsh.sh"