Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

ansible/roles/dashboard/templates/app.py.j2

@@ -24,6 +24,7 @@ SERVICES = [
     ("Registry",  "https://{{ domain_registry }}/v2/",      401, "https://{{ domain_registry }}"),
     ("k8s",          "https://{{ domain_k8s }}",                200, "https://{{ domain_k8s }}"),
     ("Vaultwarden",  "https://{{ domain_vault }}",             200, "https://{{ domain_vault }}"),
+    ("Downloads",    "https://{{ domain_dl }}",               200, "https://{{ domain_dl }}"),
 ]
 {% raw %}