Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

docs/runbook-configuration.md

@@ -24,6 +24,7 @@ The script checks these endpoints and verifies the expected HTTP status code:
 | `https://cr.ladkau.de/v2/` | 401 | Registry API — auth required, correct without credentials |
 | `https://k8s.ladkau.de` | 200 | Placeholder page |
 | `https://vault.ladkau.de` | 200 | Vaultwarden web vault |
+| `https://dl.ladkau.de` | 200 | Public download server |
 
 A `000` result means the connection was refused or timed out — a container that
 did not start. Keycloak and Nextcloud may return `502` for up to 90 seconds on
@@ -234,7 +235,58 @@ automatically (public self-registration is otherwise disabled).
 In any official Bitwarden client, set the **Server URL** to
 `https://vault.ladkau.de` before logging in.
 
-## 7. Container registry
+## 7. Download server
+
+Files placed under `dl.ladkau.de` are publicly browsable and downloadable over
+HTTPS. Upload is via SFTP on port 2223, key auth only.
+
+### 7.1 Generate the deploy key
+
+Run this once locally and keep both files:
+
+```bash
+ssh-keygen -t ed25519 -f dl_deploy_key -N "" -C "gitea-actions"
+```
+
+- Add the contents of `dl_deploy_key.pub` to the vault as `dl_sftp_authorized_keys`
+  and redeploy (`--tags dl`) to authorise the key.
+- Store `dl_deploy_key` (the private key) as a Gitea Actions secret named
+  `DL_SSH_KEY` in any repository that needs to publish releases.
+
+### 7.2 Upload from Gitea Actions
+
+Add a step to your workflow after building the binary:
+
+```yaml
+- name: Upload release
+  run: |
+    echo "${{ secrets.DL_SSH_KEY }}" > /tmp/deploy_key
+    chmod 600 /tmp/deploy_key
+    ssh -i /tmp/deploy_key -p 2223 \
+        -o StrictHostKeyChecking=no \
+        uploader@dl.ladkau.de \
+        "mkdir -p files/releases/${{ gitea.ref_name }}"
+    scp -i /tmp/deploy_key -P 2223 \
+        -o StrictHostKeyChecking=no \
+        dist/myapp-linux-amd64 \
+        uploader@dl.ladkau.de:files/releases/${{ gitea.ref_name }}/
+    rm /tmp/deploy_key
+```
+
+The file is then available at:
+`https://dl.ladkau.de/releases/v1.2.3/myapp-linux-amd64`
+
+### 7.3 Connect an SFTP client
+
+| Setting   | Value              |
+|-----------|--------------------|
+| Host      | `dl.ladkau.de`     |
+| Port      | `2223`             |
+| User      | `uploader`         |
+| Auth      | SSH key            |
+| Root path | `files/`           |
+
+## 8. Container registry
 
 ```bash
 # Login