Replace Clay with n8n, Ollama, SearXNG and browserless; add Telegram assistant

Remove the Clay role (Claude Code web UI) and its Anthropic API key.

New roles:
- ollama: local CPU LLM (qwen3:4b-instruct), internal network only
- browserless: headless Chromium for JavaScript-heavy pages
- searxng: metasearch backend for the chat web_search tool
- n8n at agent.ladkau.de: web chat (/chat), scheduled workflows,
  Telegram bot; workflows and credentials are imported from the repo

Telegram bot: Gemini 3.8 -> Gemini 3.5 -> local Qwen fallback chain,
/qwen to force the local model, /stocks and a weekday schedule
(07:30, 13:00, 17:40) for the MTE.DE / PTX.F stock report.

Also: dashboard and check-services entries for the chat, vault checks
for the new secrets (n8n, SearXNG, Gemini, Telegram, SMTP), updated
CLAUDE.md, runbooks and README.

README.md

@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="logo.png" alt="cloud.ladkau.de logo" width="200">
+</p>
+
 Info:
 --
 Server:
@@ -20,6 +24,9 @@ DNS Names:
 	mail.ladkau.de
 	cr.ladkau.de
 	k8s.ladkau.de
+	vault.ladkau.de
+	dl.ladkau.de
+	agent.ladkau.de
 
 Purpose:
 --
@@ -36,7 +43,7 @@ Provisioning: Ansible
 
 Service runtime: Docker Compose
 	Each service runs as a Docker Compose stack. Compose files live inside
-	their respective Ansible roles (roles/<service>/files/docker-compose.yml).
+	their respective Ansible roles (roles/<service>/templates/docker-compose.yml.j2).
 	This keeps service definition and deployment config together.
 
 Reverse proxy / TLS: Traefik
@@ -49,7 +56,7 @@ Repo layout:
 	ansible/
 		inventory.ini        # host address and connection vars
 		site.yml             # master playbook — runs all roles in order
-		group_vars/all.yml   # shared variables (domains, image versions, ...)
+		group_vars/all/      # vars.yml (shared variables) and vault.yml (encrypted secrets)
 		roles/
 			base/            # OS hardening, non-root user, SSH, ufw firewall
 			docker/          # Docker Engine + Compose plugin install
@@ -57,16 +64,26 @@ Repo layout:
 			gitea/           # self-hosted Git
 			nextcloud/       # file storage and collaboration
 			sso/             # Single Sign-On
-			mail/            # mail server
+			mail/            # Roundcube webmail, Dovecot, Fetchmail
 			registry/        # container registry (cr.ladkau.de)
-			k8s/             # k3s Kubernetes node
+			k8s/             # placeholder page (k8s.ladkau.de)
+			act_runner/      # Gitea Actions runners
+			vaultwarden/     # password vault (vault.ladkau.de)
+			dl/              # download server (dl.ladkau.de)
+			dashboard/       # status dashboard (cloud.ladkau.de)
+			ollama/          # local LLM server (internal network only)
+			browserless/     # headless Chromium (internal network only)
+			searxng/         # metasearch for the chat web_search tool (internal network only)
+			n8n/             # AI chat and scheduled digests (agent.ladkau.de)
 	docs/
 		runbook-provisioning.md  # step-by-step reinstall instructions
 		runbook-configuration.md # first-run service configuration
+		runbook-mail-import.md   # migrating mbox mail to Maildir++
 	scripts/
 		run-bootstrap.sh     # bootstrap deploy user on a fresh server
 		bootstrap-deploy-user.sh  # runs on server as root — creates deploy user
 		check-vault.sh       # verify vault.yml has all required secrets
+		check-services.sh    # verify all service endpoints respond
 	keys/
 		*.pub                # public SSH keys (private keys are gitignored)