Fix all issues found during first live provisioning run

Traefik:
- Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure
  with Docker Engine 29 (which dropped support for API < 1.40)

Directory permissions:
- Change all service parent directories from 0750 to 0755 so container
  processes can traverse them after dropping from root to a lower UID
- Create db directories owned by postgres UID 999 (mode 0700) so
  PostgreSQL can access its data files across Ansible runs
- Create /opt/gitea/data owned by git UID 1000 (Gitea writes there
  after dropping privileges)

Healthchecks:
- Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe
  (pipe was unreliable in Alpine)
- Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000
  (curl not available in UBI image; was incorrectly targeting port 8080)

Image tags:
- Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache

Bootstrap scripts:
- bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
  (deploy user has no password so sudo group alone was not enough)
- run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys
  automatically, show actual SSH error on failure

Inventory / config:
- Add ansible_host to inventory.ini — server IP now defined in one place
- Restructure group_vars/ into all/ directory so vault.yml is
  auto-loaded (previously it did not match any group name)
- Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir)

Docs:
- Split runbook.md into runbook-provisioning.md and
  runbook-configuration.md
- Add step 1 (set server IP) to provisioning runbook
- Expand prerequisites with SSH key generation and upload instructions
- Expand bootstrap step with preflight check details

README.md

@@ -65,7 +65,8 @@ Repo layout:
 			registry/        # container registry (cr.ladkau.de)
 			k8s/             # k3s Kubernetes node
 	docs/
-		runbook.md           # step-by-step reinstall instructions
+		runbook-provisioning.md  # step-by-step reinstall instructions
+		runbook-configuration.md # first-run service configuration
 	scripts/
 		run-bootstrap.sh     # bootstrap deploy user on a fresh server
 		bootstrap-deploy-user.sh  # runs on server as root — creates deploy user