Bring the docs up to date with the running stack

The READMEs, CLAUDE.md and todo.md still described Authentik, services
removed long ago (Ghost, MMDL, Postiz, Pinchflat...) and two servers. Now
they list the 24 services actually deployed (checked against docker ps),
explain that netcup and docker-01 are one machine, document Gondulf,
StarPunk, Listmonk, Gokapi and dockcheck, and use bin/deploy throughout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/common/README.md

@@ -1,23 +1,13 @@
 # Common Role
 
-## Purpose
-Provides shared configuration and security setup that applies to all servers in the infrastructure.
+Base setup applied first by `site.yml` (tag `common`).
 
-## What It Does
-
-### System Packages
-- Installs `aptitude` for better package management and dependency resolution
-- Updates package cache to ensure latest package information
-
-### Security Configuration
-- Enables UFW (Uncomplicated Firewall) with default deny policy
-- Provides baseline firewall protection for all managed servers
+## What it does
+- Installs `aptitude` and `jq`.
+- Makes sure UFW is enabled with default deny. The SSH rule comes from the
+  bootstrap role, and container rules from `ufw-docker` in the docker role.
 
 ## Usage
-This role is automatically applied to all servers in the infrastructure as part of the main site.yml playbook. It ensures consistent base configuration across all managed systems.
-
-## Dependencies
-None - this is a foundational role that other roles can depend on.
-
-## Notes
-This role is designed to be lightweight and provide only the most essential common functionality. Server-specific configurations should be handled by dedicated roles like `docker` or `bootstrap`.
+```bash
+bin/deploy --tags common
+```