refactor: split monolithic playbook into 9 focused ansible roles

Refactored the single ansible-playbook.yml into granular roles under roles/:
- packages: dnf update + package installs
- directories: /opt/apps/* directory creation
- sysctl: ip_forward, src_valid_mark, vm.max_map_count tuning
- network: npm_internal podman network
- wireguard: kernel module, wg-easy container, nftables hook patching
- npm: Nginx Proxy Manager container
- gitea: Gitea container
- jellyfin: Jellyfin container
- wazuh: cert generation + indexer/manager/dashboard containers

Top-level playbook is now a role dispatcher with image pre-pull kept
upfront. n8n deployment kept as commented-out guidance with an enable
checklist. All variables remain in top-level vars.yml.

Done by Sisyphus.

roles/gitea/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Deploy Gitea
+  containers.podman.podman_container:
+    image: docker.gitea.com/gitea:nightly
+    name: gitea
+    env:
+      USER_UID: 1000
+      USER_GID: 1000
+    restart_policy: always
+    recreate: true
+    state: started
+    volumes:
+      - /opt/apps/gitea:/data:z
+      - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    network:
+      - npm_internal
+    ip: '10.10.0.25'
+    ports:
+      - "222:22"