Manage Gondulf and StarPunk with Ansible

Both were hand-deployed to /opt/stacks. Templates match the live setup
and keep the same stack dirs and volume names, so data stays put.
Secrets come from the vault; .env and the StarPunk compose file are now
0640 root:docker instead of the broken 1204 mode. Adds their DNS
records to dns.yml and drops the dead godulf. Caddy route (no DNS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/gondulf-env.j2

@@ -0,0 +1,9 @@
+GONDULF_SECRET_KEY={{ vault_gondulf.secret_key }}
+GONDULF_BASE_URL=https://{{ subdomains.gondulf }}
+GONDULF_DATABASE_URL=sqlite:////data/gondulf.db
+GONDULF_SMTP_HOST={{ smtp.host }}
+GONDULF_SMTP_PORT=587
+GONDULF_SMTP_USERNAME={{ smtp.username }}
+GONDULF_SMTP_PASSWORD={{ vault_smtp.password }}
+GONDULF_SMTP_FROM=gondulf@{{ smtp.from_domain }}
+GONDULF_SMTP_USE_TLS=true