Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

docs/runbook-provisioning.md

@@ -78,6 +78,7 @@ Let's Encrypt certificates on first start and DNS must resolve at that point.
 | mail.ladkau.de      | A → server IP |
 | cr.ladkau.de        | A → server IP |
 | k8s.ladkau.de       | A → server IP |
+| vault.ladkau.de     | A → server IP |
 
 ### 4. Create the vault and populate secrets
 
@@ -118,17 +119,23 @@ registry_users:
   - username: alice
     password: "your-password"
 
-# Dovecot IMAP users — generate with: openssl rand -hex 32
+# Vaultwarden password vault
+vaultwarden_admin_token: ""        # generate: openssl rand -hex 32
+# vaultwarden_sso_client_secret is added after Keycloak is configured — see
+# step 2.6 of runbook-configuration.md
+
+# Dovecot IMAP users
 dovecot_users:
   - username: alice
     password: "your-password"
 
 # Fetchmail — external POP3 accounts to pull from (omit section if not needed)
+# local_user must match a username defined in dovecot_users above
 # fetchmail_accounts:
 #   - server: pop.gmail.com
 #     username: user@gmail.com
 #     password: app-password    # use a Gmail App Password, not your main password
-#     local_user: alice
+#     local_user: alice         # must match a dovecot_users entry
 #     ssl: true
 #     keep: true                # set false to delete from source after fetching
 #     poll_minutes: 10          # how often to poll this account (default: 10)
@@ -188,8 +195,9 @@ This runs all roles in order:
 | 6 | `sso`      | Keycloak single sign-on with PostgreSQL |
 | 7 | `mail`     | Roundcube webmail client with PostgreSQL |
 | 8 | `registry` | Docker Registry v2 with htpasswd auth |
-| 9 | `k8s`      | Placeholder page at k8s.ladkau.de |
-| 10 | `dashboard` | Public status dashboard at cloud.ladkau.de — service health and server stats |
+| 9 | `k8s`         | Placeholder page at k8s.ladkau.de |
+| 10 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
+| 11 | `dashboard`   | Public status dashboard at cloud.ladkau.de — service health and server stats |
 
 To apply a single role: