Add Dovecot IMAP + Fetchmail, fix Gitea SSO, simplify credential management

- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
  Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
  configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
  allows Keycloak-authenticated users to get accounts while blocking public sign-up;
  disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
  plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
  at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
  list-type secrets
- Update provisioning and configuration runbooks throughout

ansible/roles/mail/templates/docker-compose.yml.j2

@@ -18,6 +18,41 @@ services:
       timeout: 5s
       retries: 5
 
+  dovecot:
+    image: dovecot/dovecot:{{ dovecot_version }}
+    container_name: dovecot
+    restart: unless-stopped
+    volumes:
+      - {{ mail_data_dir }}/dovecot.conf:/etc/dovecot/dovecot.conf:ro
+      - {{ mail_data_dir }}/passwd:/etc/dovecot/passwd:ro
+      - {{ mail_data_dir }}/maildir:/var/mail
+    networks:
+      - traefik_public
+      - mail_internal
+    labels:
+      - "traefik.enable=true"
+      # TCP router — Traefik terminates TLS on port 993 and forwards plain IMAP to port 143
+      - "traefik.tcp.routers.imaps.rule=HostSNI(`{{ domain_mail }}`)"
+      - "traefik.tcp.routers.imaps.entrypoints=imaps"
+      - "traefik.tcp.routers.imaps.tls.certresolver=letsencrypt"
+      - "traefik.tcp.services.imaps.loadbalancer.server.port=143"
+
+{% if fetchmail_accounts | default([]) | length > 0 %}
+  fetchmail:
+    image: alpine:3
+    container_name: fetchmail
+    restart: unless-stopped
+    # apk add runs on each start — acceptable for a home server
+    command: ["sh", "-c", "apk add --no-cache fetchmail && exec fetchmail --nodetach -f /etc/fetchmail/fetchmailrc"]
+    volumes:
+      - {{ mail_data_dir }}/fetchmailrc:/etc/fetchmail/fetchmailrc:ro
+    networks:
+      - traefik_public
+      - mail_internal
+    depends_on:
+      - dovecot
+
+{% endif %}
   roundcube:
     image: roundcube/roundcubemail:{{ roundcube_version }}
     container_name: roundcube
@@ -30,14 +65,13 @@ services:
       ROUNDCUBEMAIL_DB_USER: roundcube
       ROUNDCUBEMAIL_DB_PASSWORD: "{{ roundcube_db_password }}"
       ROUNDCUBEMAIL_DB_NAME: roundcube
-      # IMAP — leave empty to let users enter their own server at login,
-      # or set to a specific host to lock it down (e.g. ssl://imap.example.com)
-      ROUNDCUBEMAIL_DEFAULT_HOST: "{{ roundcube_imap_host }}"
-      ROUNDCUBEMAIL_DEFAULT_PORT: "{{ roundcube_imap_port }}"
-      # SMTP
+      # IMAP — local Dovecot container
+      ROUNDCUBEMAIL_DEFAULT_HOST: "dovecot"
+      ROUNDCUBEMAIL_DEFAULT_PORT: "143"
+      # SMTP — outgoing mail server (leave empty if not configured)
       ROUNDCUBEMAIL_SMTP_SERVER: "{{ roundcube_smtp_host }}"
       ROUNDCUBEMAIL_SMTP_PORT: "{{ roundcube_smtp_port }}"
-      # Security — 24-character random string used to encrypt session data
+      # Security
       ROUNDCUBEMAIL_DES_KEY: "{{ roundcube_des_key }}"
       ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
     networks:
@@ -53,6 +87,8 @@ services:
     depends_on:
       mail-db:
         condition: service_healthy
+      dovecot:
+        condition: service_started
 
 networks:
   traefik_public: