Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.

ansible/roles/gitea/templates/docker-compose.yml.j2

@@ -0,0 +1,64 @@
+# Managed by Ansible — do not edit manually
+services:
+  gitea:
+    image: gitea/gitea:{{ gitea_version }}
+    container_name: gitea
+    restart: unless-stopped
+    environment:
+      # Database
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=gitea-db:5432
+      - GITEA__database__NAME=gitea
+      - GITEA__database__USER=gitea
+      - GITEA__database__PASSWD={{ gitea_db_password }}
+      # Server
+      - GITEA__server__DOMAIN={{ domain_gitea }}
+      - GITEA__server__ROOT_URL=https://{{ domain_gitea }}
+      - GITEA__server__HTTP_PORT=3000
+      - GITEA__server__SSH_DOMAIN={{ domain_gitea }}
+      - GITEA__server__SSH_PORT=2222
+      # Security
+      - GITEA__security__SECRET_KEY={{ gitea_secret_key }}
+      - GITEA__security__INTERNAL_TOKEN={{ gitea_internal_token }}
+      # Disable public registration — set to false only for initial admin setup
+      - GITEA__service__DISABLE_REGISTRATION={{ gitea_disable_registration | lower }}
+    volumes:
+      - {{ gitea_data_dir }}/data:/data
+    ports:
+      - "2222:22"
+    networks:
+      - traefik_public
+      - gitea_internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.gitea.rule=Host(`{{ domain_gitea }}`)"
+      - "traefik.http.routers.gitea.entrypoints=websecure"
+      - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
+      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
+    depends_on:
+      gitea-db:
+        condition: service_healthy
+
+  gitea-db:
+    image: postgres:{{ gitea_db_version }}
+    container_name: gitea-db
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=gitea
+      - POSTGRES_PASSWORD={{ gitea_db_password }}
+      - POSTGRES_DB=gitea
+    volumes:
+      - {{ gitea_data_dir }}/db:/var/lib/postgresql/data
+    networks:
+      - gitea_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U gitea"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+networks:
+  traefik_public:
+    external: true
+  gitea_internal:
+    internal: true