Wire FreeIPA enrolment into setup_linux

Reachable via --tags sssd; reuses the existing freeipa_client role
via relative path from the umbrella playbook.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup_linux.yml

@@ -104,7 +104,19 @@
         name: "{{ inventory_hostname }}"
 
 # ==============================
-# FOURTH PLAY: BACKUP
+# FOURTH PLAY: FREEIPA / SSSD
+# ==============================
+
+- name: FreeIPA client setup
+  hosts: all
+  become: true
+  tags: never,sssd
+
+  roles:
+    - role: initial_install/roles/freeipa_client
+
+# ==============================
+# FIFTH PLAY: BACKUP
 # ==============================
 
 - import_playbook: backup.yml