Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

ansible/roles/dl/templates/docker-compose.yml.j2

@@ -0,0 +1,34 @@
+# Managed by Ansible — do not edit manually
+services:
+  dl-web:
+    image: nginx:alpine
+    container_name: dl-web
+    restart: unless-stopped
+    volumes:
+      - {{ dl_data_dir }}/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - {{ dl_data_dir }}/files:/var/www/dl:ro
+    networks:
+      - traefik_public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dl.rule=Host(`{{ domain_dl }}`)"
+      - "traefik.http.routers.dl.entrypoints=websecure"
+      - "traefik.http.routers.dl.tls.certresolver=letsencrypt"
+      - "traefik.http.services.dl.loadbalancer.server.port=80"
+      - "traefik.http.routers.dl.middlewares=rate-limit@docker"
+
+  dl-sftp:
+    image: atmoz/sftp
+    container_name: dl-sftp
+    restart: unless-stopped
+    volumes:
+      - {{ dl_data_dir }}/files:/home/{{ dl_upload_user }}/files
+      - {{ dl_data_dir }}/authorized_keys:/home/{{ dl_upload_user }}/.ssh/keys/authorized_keys:ro
+    ports:
+      - "{{ dl_sftp_port }}:22"
+    # Empty password disables password auth — key auth only
+    command: "{{ dl_upload_user }}::1001:1001:files"
+
+networks:
+  traefik_public:
+    external: true