Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.

ansible/roles/mail/templates/docker-compose.yml.j2

@@ -0,0 +1,60 @@
+# Managed by Ansible — do not edit manually
+services:
+  mail-db:
+    image: postgres:{{ roundcube_db_version }}
+    container_name: mail-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: roundcube
+      POSTGRES_PASSWORD: "{{ roundcube_db_password }}"
+      POSTGRES_DB: roundcube
+    volumes:
+      - {{ mail_data_dir }}/db:/var/lib/postgresql/data
+    networks:
+      - mail_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U roundcube"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  roundcube:
+    image: roundcube/roundcubemail:{{ roundcube_version }}
+    container_name: roundcube
+    restart: unless-stopped
+    environment:
+      # Database
+      ROUNDCUBEMAIL_DB_TYPE: pgsql
+      ROUNDCUBEMAIL_DB_HOST: mail-db
+      ROUNDCUBEMAIL_DB_PORT: "5432"
+      ROUNDCUBEMAIL_DB_USER: roundcube
+      ROUNDCUBEMAIL_DB_PASSWORD: "{{ roundcube_db_password }}"
+      ROUNDCUBEMAIL_DB_NAME: roundcube
+      # IMAP — leave empty to let users enter their own server at login,
+      # or set to a specific host to lock it down (e.g. ssl://imap.example.com)
+      ROUNDCUBEMAIL_DEFAULT_HOST: "{{ roundcube_imap_host }}"
+      ROUNDCUBEMAIL_DEFAULT_PORT: "{{ roundcube_imap_port }}"
+      # SMTP
+      ROUNDCUBEMAIL_SMTP_SERVER: "{{ roundcube_smtp_host }}"
+      ROUNDCUBEMAIL_SMTP_PORT: "{{ roundcube_smtp_port }}"
+      # Security — 24-character random string used to encrypt session data
+      ROUNDCUBEMAIL_DES_KEY: "{{ roundcube_des_key }}"
+      ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
+    networks:
+      - traefik_public
+      - mail_internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.mail.rule=Host(`{{ domain_mail }}`)"
+      - "traefik.http.routers.mail.entrypoints=websecure"
+      - "traefik.http.routers.mail.tls.certresolver=letsencrypt"
+      - "traefik.http.services.mail.loadbalancer.server.port=80"
+    depends_on:
+      mail-db:
+        condition: service_healthy
+
+networks:
+  traefik_public:
+    external: true
+  mail_internal:
+    internal: true