Manage Gondulf and StarPunk with Ansible

Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/infrastructure/main.yml

@@ -13,6 +13,10 @@
   import_tasks: pocketid.yml
   tags: pocketid
 
+- name: Install gondulf
+  import_tasks: gondulf.yml
+  tags: gondulf
+
 - name: Template out the dockge compose file
   ansible.builtin.template:
     src: dockge-compose.yml.j2