Fix provisioning errors found during first real run

- ansible.cfg: suppress Python interpreter discovery warning
- ansible/inventory.ini: add ansible_host; server IP is now defined in
  one place and read dynamically by run-bootstrap.sh
- group_vars/all/ → directory layout so vault.yml is auto-loaded by Ansible
  (previously vault.yml did not match any group name and was silently ignored)
- scripts/run-bootstrap.sh: read server IP from inventory, chmod 600 private
  keys automatically, show actual SSH error when root login fails
- scripts/bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
  (deploy user has no password so sudo group membership alone was not enough)
- nextcloud: fix Redis healthcheck (CMD-SHELL pipe was unreliable in Alpine,
  switched to CMD form with start_period)
- group_vars/all/vars.yml: fix Roundcube image tag (1.6-apache and 1.6 do not
  exist; correct tag is 1.6.x-apache)
- docs/runbook.md: expand prerequisites (SSH keys section), add step 1 for
  setting the server IP, expand bootstrap step with preflight detail, fix
  step numbering

ansible/group_vars/all/vars.yml

@@ -0,0 +1,86 @@
+---
+# Domains
+domain_base: ladkau.de
+domain_cloud:      "cloud.{{ domain_base }}"
+domain_gitea:      "gitea.{{ domain_base }}"
+domain_nextcloud:  "nextcloud.{{ domain_base }}"
+domain_sso:        "sso.{{ domain_base }}"
+domain_mail:       "mail.{{ domain_base }}"
+domain_registry:   "cr.{{ domain_base }}"
+domain_k8s:        "k8s.{{ domain_base }}"
+
+# Let's Encrypt
+acme_email: matthias.ladkau@gmail.com
+
+# Non-root deploy user created by the base role
+deploy_user: deploy
+
+# System timezone
+timezone: Europe/Berlin
+
+# Docker network shared by all services and Traefik
+traefik_network: traefik_public
+
+# Traefik
+traefik_version: v3.3
+traefik_data_dir: /opt/traefik
+# htpasswd-formatted user list for the dashboard.
+# Generate with: echo $(htpasswd -nB admin) | sed -e 's/\$/\$\$/g'
+# Store the actual value in ansible/group_vars/all/vault.yml (Ansible Vault).
+traefik_dashboard_users: ""
+
+# Gitea
+gitea_version: "1"          # major-only tag — always pulls latest 1.x patch
+gitea_db_version: "16"      # PostgreSQL major version
+gitea_data_dir: /opt/gitea
+# Set to false for the very first deploy so the admin account can be created,
+# then flip to true and redeploy to close public registration.
+gitea_disable_registration: true
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# gitea_db_password: ""
+# gitea_secret_key: ""      # generate: openssl rand -hex 32
+# gitea_internal_token: ""  # generate: openssl rand -hex 32
+
+# SSO (Keycloak)
+keycloak_version: "26.2"
+keycloak_db_version: "16"
+sso_data_dir: /opt/sso
+keycloak_admin_user: admin
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# keycloak_db_password: ""
+# keycloak_admin_password: ""
+
+# Nextcloud
+nextcloud_version: "31-apache"  # apache variant includes a working web server
+nextcloud_db_version: "16"
+nextcloud_data_dir: /opt/nextcloud
+nextcloud_admin_user: admin
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# nextcloud_db_password: ""
+# nextcloud_admin_password: ""
+
+# Mail (Roundcube webmail client)
+roundcube_version: "1.6.x-apache"
+roundcube_db_version: "16"
+mail_data_dir: /opt/mail
+# IMAP/SMTP — set to the mail server Roundcube should connect to.
+# Leave imap_host empty to let users enter their own server at login.
+# Use "ssl://hostname" for implicit TLS (port 993), or plain hostname for STARTTLS (port 143).
+roundcube_imap_host: ""
+roundcube_imap_port: "993"
+roundcube_smtp_host: ""
+roundcube_smtp_port: "587"
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# roundcube_db_password: ""
+# roundcube_des_key: ""   # generate: openssl rand -hex 12  (must be exactly 24 chars)
+
+# Container registry (Docker Registry v2)
+registry_data_dir: /opt/registry
+# registry_htpasswd — full htpasswd file content, store in vault.yml
+# Generate with: docker run --entrypoint htpasswd httpd:2 -Bbn <user> <password>
+# Multiple users: run the command once per user and concatenate the lines.
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# registry_htpasswd: ""
+
+# k8s (placeholder)
+k8s_data_dir: /opt/k8s