Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

ansible/roles/dashboard/templates/app.py.j2

@@ -22,7 +22,8 @@ SERVICES = [
     ("Keycloak",  "https://{{ domain_sso }}/realms/master", 200, "https://{{ domain_sso }}"),
     ("Roundcube", "https://{{ domain_mail }}",               200, "https://{{ domain_mail }}"),
     ("Registry",  "https://{{ domain_registry }}/v2/",      401, "https://{{ domain_registry }}"),
-    ("k8s",       "https://{{ domain_k8s }}",                200, "https://{{ domain_k8s }}"),
+    ("k8s",          "https://{{ domain_k8s }}",                200, "https://{{ domain_k8s }}"),
+    ("Vaultwarden",  "https://{{ domain_vault }}",             200, "https://{{ domain_vault }}"),
 ]
 {% raw %}