Fix Redis persistence crash-loop and provisioning dependencies

- Disable Redis RDB snapshots (--save "") — Redis is cache-only for
  Nextcloud; snapshot writes failed due to directory permissions and
  blocked all Redis writes, causing background jobs to crash-loop at
  400%+ CPU
- Add passlib as a required local dependency (needed for password_hash
  filter in Ansible templates)
- Make dl role SFTP setup conditional on dl_sftp_authorized_keys being
  set in the vault
- Fix check-vault.sh stdin conflict (pipe + heredoc) by passing vault
  content via environment variable
- Remove dl_sftp_authorized_keys from required_scalars (it is optional)

ansible/roles/dl/tasks/main.yml

@@ -24,6 +24,7 @@
     owner: root
     group: root
     mode: "0644"
+  when: dl_sftp_authorized_keys | default('') | length > 0
   notify: Restart dl
   tags: dl
 
@@ -52,6 +53,7 @@
     rule: allow
     port: "{{ dl_sftp_port }}"
     proto: tcp
+  when: dl_sftp_authorized_keys | default('') | length > 0
   tags: dl
 
 - name: Start dl stack

ansible/roles/dl/templates/docker-compose.yml.j2

@@ -17,6 +17,7 @@ services:
       - "traefik.http.services.dl.loadbalancer.server.port=80"
       - "traefik.http.routers.dl.middlewares=rate-limit@docker"
 
+{% if dl_sftp_authorized_keys | default('') | length > 0 %}
   dl-sftp:
     image: atmoz/sftp
     container_name: dl-sftp
@@ -28,6 +29,7 @@ services:
       - "{{ dl_sftp_port }}:22"
     # Empty password disables password auth — key auth only
     command: "{{ dl_upload_user }}::1001:1001:files"
+{% endif %}
 
 networks:
   traefik_public:

ansible/roles/nextcloud/templates/docker-compose.yml.j2

@@ -22,7 +22,7 @@ services:
     image: redis:7-alpine
     container_name: nextcloud-redis
     restart: unless-stopped
-    command: --save 60 1 --loglevel warning
+    command: --save "" --loglevel warning
     volumes:
       - {{ nextcloud_data_dir }}/redis:/data
     networks: