Close Karakeep signups and turn on unattended security updates

Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on
bookmarks. and use the OpenAI key behind it. The server also had no
automatic updates and three security updates waiting; the common role now
installs unattended-upgrades with Debian's default security-only origins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/common/tasks/main.yml

@@ -9,4 +9,19 @@
 - name: UFW - Enable and deny by default
   community.general.ufw:
     state: enabled
-    default: deny
+    default: deny
+# Security updates install themselves each day (Debian's default origins:
+# the -security archive only). No automatic reboots.
+- name: Install unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+
+- name: Turn on daily unattended upgrades
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    mode: '0644'
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";