Add Dovecot IMAP + Fetchmail, fix Gitea SSO, simplify credential management

- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
  Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
  configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
  allows Keycloak-authenticated users to get accounts while blocking public sign-up;
  disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
  plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
  at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
  list-type secrets
- Update provisioning and configuration runbooks throughout

ansible/group_vars/all/vars.yml

@@ -24,18 +24,16 @@ traefik_network: traefik_public
 # Traefik
 traefik_version: v3.6
 traefik_data_dir: /opt/traefik
-# htpasswd-formatted user list for the dashboard.
-# Generate with: echo $(htpasswd -nB admin) | sed -e 's/\$/\$\$/g'
-# Store the actual value in ansible/group_vars/all/vault.yml (Ansible Vault).
-traefik_dashboard_users: ""
+# Dashboard basic-auth users — plaintext passwords, Ansible generates bcrypt hashes at deploy time
+# traefik_dashboard_users:
+#   - username: admin
+#     password: "your-password"
+traefik_dashboard_users: []
 
 # Gitea
 gitea_version: "1"          # major-only tag — always pulls latest 1.x patch
 gitea_db_version: "16"      # PostgreSQL major version
 gitea_data_dir: /opt/gitea
-# Set to false for the very first deploy so the admin account can be created,
-# then flip to true and redeploy to close public registration.
-gitea_disable_registration: true
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # gitea_db_password: ""
 # gitea_secret_key: ""      # generate: openssl rand -hex 32
@@ -59,28 +57,42 @@ nextcloud_admin_user: admin
 # nextcloud_db_password: ""
 # nextcloud_admin_password: ""
 
-# Mail (Roundcube webmail client)
+# Mail (Roundcube + Dovecot IMAP + Fetchmail)
 roundcube_version: "1.6.x-apache"
 roundcube_db_version: "16"
 mail_data_dir: /opt/mail
-# IMAP/SMTP — set to the mail server Roundcube should connect to.
-# Leave imap_host empty to let users enter their own server at login.
-# Use "ssl://hostname" for implicit TLS (port 993), or plain hostname for STARTTLS (port 143).
-roundcube_imap_host: ""
-roundcube_imap_port: "993"
+# Dovecot IMAP server — Roundcube always connects to the local Dovecot container
+dovecot_version: "2.3"
+# SMTP — outgoing mail server for Roundcube (leave empty if not configured)
 roundcube_smtp_host: ""
 roundcube_smtp_port: "587"
+# Fetchmail — polls external POP3 accounts and delivers to local Dovecot via LMTP
+# poll_minutes is per-account (default: 10 minutes)
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # roundcube_db_password: ""
 # roundcube_des_key: ""   # generate: openssl rand -hex 12  (must be exactly 24 chars)
+#
+# Dovecot users — list of {username, password} pairs (plaintext, vault is encrypted)
+# dovecot_users:
+#   - username: alice
+#     password: "plaintext-password"
+#
+# Fetchmail accounts — list of external POP3 sources to poll
+# fetchmail_accounts:
+#   - server: pop.gmail.com
+#     username: user@gmail.com
+#     password: app-password
+#     local_user: alice
+#     protocol: pop3      # default: pop3
+#     ssl: true           # default: true
+#     keep: true          # default: true — set false to delete from source after fetch
 
 # Container registry (Docker Registry v2)
 registry_data_dir: /opt/registry
-# registry_htpasswd — full htpasswd file content, store in vault.yml
-# Generate with: docker run --entrypoint htpasswd httpd:2 -Bbn <user> <password>
-# Multiple users: run the command once per user and concatenate the lines.
-# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
-# registry_htpasswd: ""
+# Registry users — plaintext passwords, Ansible generates bcrypt hashes at deploy time
+# registry_users:
+#   - username: alice
+#     password: "your-password"
 
 # k8s (placeholder)
 k8s_data_dir: /opt/k8s