Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.

ansible/roles/k8s/templates/docker-compose.yml.j2

@@ -0,0 +1,20 @@
+# Managed by Ansible — do not edit manually
+services:
+  k8s-placeholder:
+    image: nginx:alpine
+    container_name: k8s-placeholder
+    restart: unless-stopped
+    volumes:
+      - {{ k8s_data_dir }}/html:/usr/share/nginx/html:ro
+    networks:
+      - traefik_public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.k8s.rule=Host(`{{ domain_k8s }}`)"
+      - "traefik.http.routers.k8s.entrypoints=websecure"
+      - "traefik.http.routers.k8s.tls.certresolver=letsencrypt"
+      - "traefik.http.services.k8s.loadbalancer.server.port=80"
+
+networks:
+  traefik_public:
+    external: true