Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

ansible/roles/dl/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: Create dl data directory
+  ansible.builtin.file:
+    path: "{{ dl_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: dl
+
+- name: Create dl files directory (sftp user UID 1001)
+  ansible.builtin.file:
+    path: "{{ dl_data_dir }}/files"
+    state: directory
+    owner: "1001"
+    group: "1001"
+    mode: "0755"
+  tags: dl
+
+- name: Deploy SFTP authorized keys
+  ansible.builtin.copy:
+    content: "{{ dl_sftp_authorized_keys }}"
+    dest: "{{ dl_data_dir }}/authorized_keys"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart dl
+  tags: dl
+
+- name: Deploy nginx config
+  ansible.builtin.template:
+    src: nginx.conf.j2
+    dest: "{{ dl_data_dir }}/nginx.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart dl
+  tags: dl
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ dl_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart dl
+  tags: dl
+
+- name: Allow SFTP port through firewall
+  community.general.ufw:
+    rule: allow
+    port: "{{ dl_sftp_port }}"
+    proto: tcp
+  tags: dl
+
+- name: Start dl stack
+  community.docker.docker_compose_v2:
+    project_src: "{{ dl_data_dir }}"
+    state: present
+    pull: missing
+  tags: dl