Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

scripts/check-services.sh

@@ -16,6 +16,7 @@ CHECKS=(
   "https://mail.ladkau.de 200 10"
   "https://cr.ladkau.de/v2/ 401 10"
   "https://k8s.ladkau.de 200 10"
+  "https://vault.ladkau.de 200 10"
 )
 
 if ! command -v curl &>/dev/null; then