Harden PAM on Linux: pwquality, faillock and MFA (with Ansible + Molecule)

A practical, reproducible guide for RHEL/Rocky/Alma and Debian/Ubuntu, with Ansible + Molecule examples. TL;DR: Secure PAM with pam_pwquality (strong passwords), pam_faillock (brute-force protection)