Add Pocket ID as a passkey login provider at id.thesatelliteoflove.com

Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/infrastructure/pocketid.yml

@@ -0,0 +1,28 @@
+- name: make pocketid directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/stacks/pocketid
+
+- name: Template out the pocketid compose file
+  ansible.builtin.template:
+    src: pocketid-compose.yml.j2
+    dest: /opt/stacks/pocketid/compose.yml
+    owner: root
+    mode: '0644'
+
+- name: Template out the pocketid .env file
+  ansible.builtin.template:
+    src: pocketid-env.j2
+    dest: /opt/stacks/pocketid/.env
+    owner: root
+    mode: '0640'
+    group: docker
+  diff: false  # contains the encryption key
+
+- name: deploy pocketid stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/stacks/pocketid
+    files:
+    - compose.yml