Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

docs/runbook-configuration.md

@@ -23,6 +23,7 @@ The script checks these endpoints and verifies the expected HTTP status code:
 | `https://mail.ladkau.de` | 200 | Roundcube webmail login |
 | `https://cr.ladkau.de/v2/` | 401 | Registry API — auth required, correct without credentials |
 | `https://k8s.ladkau.de` | 200 | Placeholder page |
+| `https://vault.ladkau.de` | 200 | Vaultwarden web vault |
 
 A `000` result means the connection was refused or timed out — a container that
 did not start. Keycloak and Nextcloud may return `502` for up to 90 seconds on
@@ -91,6 +92,21 @@ For each user you want to be able to log in to Gitea and Nextcloud:
 7. Go to the **Credentials** tab and copy the **Client secret** — you will
    need it in step 4.
 
+### 2.6 Create the Vaultwarden OIDC client
+
+1. **Clients** → **Create client**.
+2. **Client type**: OpenID Connect — **Client ID**: `vaultwarden` → **Next**.
+3. Turn **Client authentication** on → **Next**.
+4. **Valid redirect URIs**: `https://vault.ladkau.de/*`
+5. **Valid post logout redirect URIs**: `https://vault.ladkau.de/*`
+6. **Web origins**: `https://vault.ladkau.de` → **Save**.
+7. Go to the **Credentials** tab and copy the **Client secret**.
+8. Add it to the vault as `vaultwarden_sso_client_secret` and redeploy:
+   ```bash
+   ansible-vault edit ansible/group_vars/all/vault.yml
+   ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags vaultwarden --ask-vault-pass
+   ```
+
 ## 3. Gitea
 
 ### 3.1 Create the admin account
@@ -196,7 +212,29 @@ imapsync \
 | Security  | SSL/TLS              |
 | Username  | as set in vault      |
 
-## 6. Container registry
+## 6. Vaultwarden
+
+Vaultwarden is a self-hosted Bitwarden-compatible password vault. Any official
+Bitwarden client (browser extension, desktop, mobile) can connect to it.
+
+### 6.1 Log in to the admin panel
+
+Go to `https://vault.ladkau.de/admin/` and enter the `vaultwarden_admin_token`
+from the vault. From here you can invite users and manage the instance.
+
+### 6.2 Sign in with Keycloak SSO
+
+Users can sign in at `https://vault.ladkau.de` using the **Enterprise Single
+Sign-On** button — enter `https://sso.ladkau.de/realms/ladkau` as the
+organisation identifier. On first login Vaultwarden creates an account
+automatically (public self-registration is otherwise disabled).
+
+### 6.3 Connect a Bitwarden client
+
+In any official Bitwarden client, set the **Server URL** to
+`https://vault.ladkau.de` before logging in.
+
+## 7. Container registry
 
 ```bash
 # Login