Add Dovecot IMAP + Fetchmail, fix Gitea SSO, simplify credential management

- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
  Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
  configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
  allows Keycloak-authenticated users to get accounts while blocking public sign-up;
  disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
  plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
  at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
  list-type secrets
- Update provisioning and configuration runbooks throughout

ansible/roles/mail/templates/dovecot.conf.j2

@@ -0,0 +1,43 @@
+# Managed by Ansible — do not edit manually
+protocols = imap lmtp
+
+# Plaintext auth is fine — connections come from within Docker or via
+# Traefik TLS termination, never plain from the internet
+disable_plaintext_auth = no
+auth_mechanisms = plain login
+
+passdb {
+  driver = passwd-file
+  args = /etc/dovecot/passwd
+}
+
+userdb {
+  driver = passwd-file
+  args = /etc/dovecot/passwd
+  default_fields = uid=5000 gid=5000 home=/var/mail/%u
+}
+
+mail_location = maildir:/var/mail/%u/Maildir
+mail_uid = 5000
+mail_gid = 5000
+
+service imap-login {
+  inet_listener imap {
+    port = 143
+  }
+  # IMAPS disabled — Traefik terminates TLS on port 993 and forwards plain IMAP
+  inet_listener imaps {
+    port = 0
+  }
+}
+
+# LMTP listener for fetchmail delivery — reachable on mail_internal network only
+service lmtp {
+  inet_listener lmtp {
+    address = *
+    port = 24
+  }
+}
+
+# SSL disabled — Traefik handles TLS
+ssl = no