Run Gokapi's first-run password step as a blocking command

--deployment-password sets the password and exits, so the detached run
plus health wait never saw a healthy container.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/productivity/gokapi.yml

@@ -35,30 +35,15 @@
 
 # A new database has no users and Gokapi refuses to start, so run it once with
 # --deployment-password to create the super admin (the Pocket ID email above).
+# Gokapi exits after setting the password.
 - name: Create the gokapi super admin on a fresh install
+  ansible.builtin.command:
+    cmd: >-
+      docker compose run --rm --no-deps gokapi
+      /app/run.sh --deployment-password {{ vault_gokapi.deployment_password }}
+    chdir: /opt/stacks/gokapi
   when: not gokapi_db.stat.exists
-  block:
-    - name: Start a one-off gokapi with a deployment password
-      ansible.builtin.command:
-        cmd: >-
-          docker compose run -d --rm --no-deps --name gokapi-init gokapi
-          /app/run.sh --deployment-password {{ vault_gokapi.deployment_password }}
-        chdir: /opt/stacks/gokapi
-      no_log: true
-
-    - name: Wait for the one-off gokapi to finish starting
-      ansible.builtin.command: docker inspect -f '{{ "{{" }}.State.Health.Status{{ "}}" }}' gokapi-init
-      register: gokapi_init_health
-      until: gokapi_init_health.stdout == "healthy"
-      retries: 30
-      delay: 3
-      changed_when: false
-  always:
-    - name: Stop the one-off gokapi
-      ansible.builtin.command: docker rm -f gokapi-init
-      when: not gokapi_db.stat.exists
-      changed_when: true
-      failed_when: false
+  no_log: true
 
 - name: deploy gokapi stack
   community.docker.docker_compose_v2: