Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

ansible/group_vars/all/vars.yml

@@ -8,6 +8,7 @@ domain_sso:        "sso.{{ domain_base }}"
 domain_mail:       "mail.{{ domain_base }}"
 domain_registry:   "cr.{{ domain_base }}"
 domain_k8s:        "k8s.{{ domain_base }}"
+domain_vault:      "vault.{{ domain_base }}"
 
 # Let's Encrypt
 acme_email: matthias.ladkau@gmail.com
@@ -97,5 +98,12 @@ registry_data_dir: /opt/registry
 # k8s (placeholder)
 k8s_data_dir: /opt/k8s
 
+# Vaultwarden (self-hosted Bitwarden-compatible password vault)
+vaultwarden_version: "latest"
+vaultwarden_data_dir: /opt/vaultwarden
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# vaultwarden_admin_token: ""       # generate: openssl rand -hex 32
+# vaultwarden_sso_client_secret: "" # added after Keycloak is configured — see runbook-configuration.md step 2.6
+
 # Status dashboard (public — cloud.ladkau.de root)
 dashboard_data_dir: /opt/dashboard