Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

ansible/group_vars/all/vars.yml

@@ -9,6 +9,7 @@ domain_mail:       "mail.{{ domain_base }}"
 domain_registry:   "cr.{{ domain_base }}"
 domain_k8s:        "k8s.{{ domain_base }}"
 domain_vault:      "vault.{{ domain_base }}"
+domain_dl:         "dl.{{ domain_base }}"
 
 # Let's Encrypt
 acme_email: matthias.ladkau@gmail.com
@@ -105,5 +106,13 @@ vaultwarden_data_dir: /opt/vaultwarden
 # vaultwarden_admin_token: ""       # generate: openssl rand -hex 32
 # vaultwarden_sso_client_secret: "" # added after Keycloak is configured — see runbook-configuration.md step 2.6
 
+# Download server (nginx HTTPS + SFTP)
+dl_data_dir: /opt/dl
+dl_upload_user: uploader
+dl_sftp_port: 2223
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# dl_sftp_authorized_keys: |
+#   ssh-ed25519 AAAA...  gitea-actions
+
 # Status dashboard (public — cloud.ladkau.de root)
 dashboard_data_dir: /opt/dashboard