Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

docs/runbook-provisioning.md

@@ -79,6 +79,7 @@ Let's Encrypt certificates on first start and DNS must resolve at that point.
 | cr.ladkau.de        | A → server IP |
 | k8s.ladkau.de       | A → server IP |
 | vault.ladkau.de     | A → server IP |
+| dl.ladkau.de        | A → server IP |
 
 ### 4. Create the vault and populate secrets
 
@@ -124,6 +125,12 @@ vaultwarden_admin_token: ""        # generate: openssl rand -hex 32
 # vaultwarden_sso_client_secret is added after Keycloak is configured — see
 # step 2.6 of runbook-configuration.md
 
+# Download server — SFTP upload key
+# Generate: ssh-keygen -t ed25519 -f dl_deploy_key -N "" -C "gitea-actions"
+# Paste the contents of dl_deploy_key.pub here; store dl_deploy_key as a Gitea Actions secret
+dl_sftp_authorized_keys: |
+  ssh-ed25519 AAAA...
+
 # Dovecot IMAP users
 dovecot_users:
   - username: alice
@@ -147,6 +154,16 @@ Verify all secrets are present and non-empty:
 bash scripts/check-vault.sh
 ```
 
+The script enforces three tiers:
+- **Required scalars** — must be present and non-empty (all secrets above except
+  `vaultwarden_sso_client_secret` and `dl_sftp_authorized_keys`)
+- **Required lists** — must be present and contain at least one entry
+  (`traefik_dashboard_users`, `registry_users`, `dovecot_users`)
+- **Optional but validated when present** — if the key exists in the vault it
+  must pass a format check:
+  - `vaultwarden_sso_client_secret` — non-empty string (added after Keycloak is configured)
+  - `dl_sftp_authorized_keys` — must begin with a recognised SSH public key prefix
+
 To edit the vault later:
 
 ```bash
@@ -165,8 +182,8 @@ The script runs the following steps in order:
 1. Verifies all four key files exist under `keys/` (both root and deploy key pairs)
 2. Verifies `scripts/bootstrap-deploy-user.sh` exists
 3. Sets `chmod 600` on the private key files (SSH refuses keys with open permissions)
-4. Runs `scripts/check-vault.sh` — decrypts the vault and confirms all 11 required
-   secrets are present and non-empty
+4. Runs `scripts/check-vault.sh` — decrypts the vault, confirms all required
+   secrets are present and non-empty, and validates optional secrets when present
 
 **Remote actions**
 5. Opens a test SSH connection as `root` to confirm the root key works
@@ -197,7 +214,8 @@ This runs all roles in order:
 | 8 | `registry` | Docker Registry v2 with htpasswd auth |
 | 9 | `k8s`         | Placeholder page at k8s.ladkau.de |
 | 10 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
-| 11 | `dashboard`   | Public status dashboard at cloud.ladkau.de — service health and server stats |
+| 11 | `dl`          | Public download server at dl.ladkau.de — nginx HTTPS + SFTP upload |
+| 12 | `dashboard`   | Public status dashboard at cloud.ladkau.de — service health and server stats |
 
 To apply a single role:
 
@@ -211,5 +229,5 @@ ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags <role> --ask-v
 |--------|---------|
 | `scripts/run-bootstrap.sh` | Copy and run the deploy user bootstrap on a fresh server |
 | `scripts/bootstrap-deploy-user.sh` | Runs on the server as root — creates the deploy user |
-| `scripts/check-vault.sh` | Verify vault.yml exists and all required secrets are non-empty |
+| `scripts/check-vault.sh` | Verify required secrets are present; validate optional secrets (`vaultwarden_sso_client_secret`, `dl_sftp_authorized_keys`) when present |
 | `scripts/check-services.sh` | Verify all service endpoints are reachable (run after provisioning) |