Harden web-01 and prove it

Before you start

You are grcops on a freshly provisioned Ubuntu host, web-01, holding a three-line hardening standard: administration only by a named non-root user with sudo; SSH accepts keys only — no passwords, no root login; and a defined background service installed, running, and enabled to survive a reboot. Implement each control, then prove each one from the host's own commands — evidence a reviewer can re-run, not a screenshot. This terminal is a real simulation of web-01: its outputs are captured from a real systemd-enabled Linux machine, and the same commands on a real box give the same answers. Your sudo password is labpass.