feat: implement comprehensive variable management system

- Create standardized group_vars directory structure
- Add domains.yml with centralized subdomain mappings
- Add infrastructure.yml with network, SMTP, and path config
- Reorganize vault.yml secrets by service with consistent naming
- Update 15+ Docker compose templates to use new variable structure
- Simplify playbook commands by removing --extra-vars requirement
- Replace hardcoded domains/IPs with template variables
- Standardize secret references across all services

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

roles/docker/templates/hoarder-env.j2

@@ -1,10 +1,10 @@
 KARAKEEP_VERSION=release
-NEXTAUTH_SECRET={{ hoarder_nextauth_secret }}
-MEILI_MASTER_KEY={{ hoarder_meili_master_key }}
-NEXTAUTH_URL=https://bookmarks.thesatelliteoflove.com
-OPENAI_API_KEY={{ openai_api_key }}
-OAUTH_CLIENT_SECRET={{ hoarder_oidc_client_secret }}
+NEXTAUTH_SECRET={{ vault_hoarder.nextauth_secret }}
+MEILI_MASTER_KEY={{ vault_hoarder.meili_master_key }}
+NEXTAUTH_URL=https://{{ subdomains.bookmarks }}
+OPENAI_API_KEY={{ vault_infrastructure.openai_api_key }}
+OAUTH_CLIENT_SECRET={{ vault_hoarder.oidc.client_secret }}
 OAUTH_CLIENT_ID=GTi0QBRH5TiTqZfxfAkYSQVVFouGdlOFMc2sjivN
 OAUTH_PROVIDER_NAME=Authentik
-OAUTH_WELLKNOWN_URL=https://auth.thesatelliteoflove.com/application/o/hoarder/.well-known/openid-configuration
+OAUTH_WELLKNOWN_URL=https://{{ subdomains.auth }}/application/o/hoarder/.well-known/openid-configuration
 OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true