extract-fw-host-vars.py: abort if a conf file cannot be read; add --from-dir. Migrate cl-test.

Previously an unreadable file (e.g. /etc/ipt-firewall is 0750 after the
role ran) silently produced almost empty host_vars. The script now exits
with an error and writes nothing. --from-dir reads the conf files from a
local directory, e.g. fetched with ansible using the vaulted become
password.

Add host_vars for cl-test.oopen.de (fw_manage_config: true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/ipt-server/MIGRATION.md

@@ -60,7 +60,21 @@ HOSTNAME=<hostname>
   -o host_vars/${HOSTNAME}/${HOSTNAME%.*.*}-ipt-server.yml
 ```
 
-Das Skript fragt einmalig nach dem `sudo`-Passwort.
+Das Skript fragt einmalig nach dem `sudo`-Passwort. Kann eine der Dateien nicht
+gelesen werden, bricht es ab, ohne etwas zu schreiben.
+
+Alternativ ohne Passwortabfrage (sudo über `ansible_become_password` aus dem Vault):
+die Dateien mit Ansible holen und lokal einlesen:
+
+```bash
+for f in interfaces_ipv4 interfaces_ipv6 main_ipv4 main_ipv6 ; do
+   ansible ${HOSTNAME} -b -m fetch \
+      -a "src=/etc/ipt-firewall/${f}.conf dest=/tmp/fw-${HOSTNAME}/ flat=yes"
+done
+./extract-fw-host-vars.py ${HOSTNAME} --from-dir /tmp/fw-${HOSTNAME} \
+  -o host_vars/${HOSTNAME}/${HOSTNAME%.*.*}-ipt-server.yml
+rm -rf /tmp/fw-${HOSTNAME}
+```
 
 **Ergebnis prüfen:**