Add Dovecot IMAP + Fetchmail, fix Gitea SSO, simplify credential management

- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
  Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
  configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
  allows Keycloak-authenticated users to get accounts while blocking public sign-up;
  disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
  plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
  at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
  list-type secrets
- Update provisioning and configuration runbooks throughout

ansible/roles/mail/tasks/main.yml

@@ -1,6 +1,5 @@
 ---
-# Roundcube webmail client — connects to any external IMAP/SMTP server
-- name: Create Roundcube data directories
+- name: Create mail data directories
   ansible.builtin.file:
     path: "{{ item }}"
     state: directory
@@ -20,6 +19,45 @@
     mode: "0700"
   tags: mail
 
+- name: Create Dovecot maildir (vmail UID 5000)
+  ansible.builtin.file:
+    path: "{{ mail_data_dir }}/maildir"
+    state: directory
+    owner: "5000"
+    group: "5000"
+    mode: "0755"
+  tags: mail
+
+- name: Deploy Dovecot config
+  ansible.builtin.template:
+    src: dovecot.conf.j2
+    dest: "{{ mail_data_dir }}/dovecot.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart mail
+  tags: mail
+
+- name: Deploy Dovecot passwd file
+  ansible.builtin.template:
+    src: passwd.j2
+    dest: "{{ mail_data_dir }}/passwd"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: Restart mail
+  tags: mail
+
+- name: Deploy fetchmail config
+  ansible.builtin.template:
+    src: fetchmailrc.j2
+    dest: "{{ mail_data_dir }}/fetchmailrc"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart mail
+  tags: mail
+
 - name: Deploy Docker Compose file
   ansible.builtin.template:
     src: docker-compose.yml.j2
@@ -30,7 +68,7 @@
   notify: Restart mail
   tags: mail
 
-- name: Start Roundcube
+- name: Start mail stack
   community.docker.docker_compose_v2:
     project_src: "{{ mail_data_dir }}"
     state: present