Fix provisioning errors found during first real run

- ansible.cfg: suppress Python interpreter discovery warning
- ansible/inventory.ini: add ansible_host; server IP is now defined in
  one place and read dynamically by run-bootstrap.sh
- group_vars/all/ → directory layout so vault.yml is auto-loaded by Ansible
  (previously vault.yml did not match any group name and was silently ignored)
- scripts/run-bootstrap.sh: read server IP from inventory, chmod 600 private
  keys automatically, show actual SSH error when root login fails
- scripts/bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
  (deploy user has no password so sudo group membership alone was not enough)
- nextcloud: fix Redis healthcheck (CMD-SHELL pipe was unreliable in Alpine,
  switched to CMD form with start_period)
- group_vars/all/vars.yml: fix Roundcube image tag (1.6-apache and 1.6 do not
  exist; correct tag is 1.6.x-apache)
- docs/runbook.md: expand prerequisites (SSH keys section), add step 1 for
  setting the server IP, expand bootstrap step with preflight detail, fix
  step numbering

ansible/group_vars/all/vars.yml

@@ -26,7 +26,7 @@ traefik_version: v3.3
 traefik_data_dir: /opt/traefik
 # htpasswd-formatted user list for the dashboard.
 # Generate with: echo $(htpasswd -nB admin) | sed -e 's/\$/\$\$/g'
-# Store the actual value in ansible/group_vars/vault.yml (Ansible Vault).
+# Store the actual value in ansible/group_vars/all/vault.yml (Ansible Vault).
 traefik_dashboard_users: ""
 
 # Gitea
@@ -36,7 +36,7 @@ gitea_data_dir: /opt/gitea
 # Set to false for the very first deploy so the admin account can be created,
 # then flip to true and redeploy to close public registration.
 gitea_disable_registration: true
-# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # gitea_db_password: ""
 # gitea_secret_key: ""      # generate: openssl rand -hex 32
 # gitea_internal_token: ""  # generate: openssl rand -hex 32
@@ -46,7 +46,7 @@ keycloak_version: "26.2"
 keycloak_db_version: "16"
 sso_data_dir: /opt/sso
 keycloak_admin_user: admin
-# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # keycloak_db_password: ""
 # keycloak_admin_password: ""
 
@@ -55,12 +55,12 @@ nextcloud_version: "31-apache"  # apache variant includes a working web server
 nextcloud_db_version: "16"
 nextcloud_data_dir: /opt/nextcloud
 nextcloud_admin_user: admin
-# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # nextcloud_db_password: ""
 # nextcloud_admin_password: ""
 
 # Mail (Roundcube webmail client)
-roundcube_version: "1.6-apache"
+roundcube_version: "1.6.x-apache"
 roundcube_db_version: "16"
 mail_data_dir: /opt/mail
 # IMAP/SMTP — set to the mail server Roundcube should connect to.
@@ -70,7 +70,7 @@ roundcube_imap_host: ""
 roundcube_imap_port: "993"
 roundcube_smtp_host: ""
 roundcube_smtp_port: "587"
-# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # roundcube_db_password: ""
 # roundcube_des_key: ""   # generate: openssl rand -hex 12  (must be exactly 24 chars)
 
@@ -79,7 +79,7 @@ registry_data_dir: /opt/registry
 # registry_htpasswd — full htpasswd file content, store in vault.yml
 # Generate with: docker run --entrypoint htpasswd httpd:2 -Bbn <user> <password>
 # Multiple users: run the command once per user and concatenate the lines.
-# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # registry_htpasswd: ""
 
 # k8s (placeholder)