Manage Gondulf and StarPunk with Ansible

Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

group_vars/all/domains.yml

@@ -27,6 +27,8 @@ subdomains:
   listmonk: "listmonk.{{ secondary_domain }}"  # Listmonk mailing list
   gokapi: "gokapi.{{ primary_domain }}"  # Gokapi file sharing
   pocketid: "id.{{ primary_domain }}"  # Pocket ID passkey OIDC
+  gondulf: "gondulf.{{ primary_domain }}"  # IndieAuth for the main site
+  starpunk: "starpunk.{{ primary_domain }}"  # Micropub for the main site
 
 # Email domains for notifications
 email_domains: