Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

ansible/roles/dl/templates/nginx.conf.j2

@@ -0,0 +1,19 @@
+# Managed by Ansible — do not edit manually
+server {
+    listen 80;
+    server_name _;
+
+    root /var/www/dl;
+    charset utf-8;
+
+    location / {
+        autoindex on;
+        autoindex_exact_size off;
+        autoindex_localtime on;
+    }
+
+    # Deny access to hidden files
+    location ~ /\. {
+        deny all;
+    }
+}