Manage Gondulf and StarPunk with Ansible

Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

group_vars/docker/services.yml

@@ -2,11 +2,11 @@
 
 # Service categories for organization
 service_categories:
-  infrastructure: ["caddy", "authentik", "dockge"]
+  infrastructure: ["caddy", "authentik", "dockge", "gondulf"]
   development: ["gitea", "bytestash"]
   media: ["audiobookshelf", "kavita", "hoarder", "manyfold"]
   productivity: ["paperlessngx", "baikal", "syncthing", "heyform", "dawarich", "obsidian-livesync", "gokapi"]
-  communication: ["gotosocial", "listmonk"]
+  communication: ["gotosocial", "listmonk", "starpunk"]
   monitoring: ["changedetection", "appriseapi", "gotify", "cronmaster"]
 
 # Common service configuration