refactor: split monolithic playbook into 9 focused ansible roles

Refactored the single ansible-playbook.yml into granular roles under roles/:
- packages: dnf update + package installs
- directories: /opt/apps/* directory creation
- sysctl: ip_forward, src_valid_mark, vm.max_map_count tuning
- network: npm_internal podman network
- wireguard: kernel module, wg-easy container, nftables hook patching
- npm: Nginx Proxy Manager container
- gitea: Gitea container
- jellyfin: Jellyfin container
- wazuh: cert generation + indexer/manager/dashboard containers

Top-level playbook is now a role dispatcher with image pre-pull kept
upfront. n8n deployment kept as commented-out guidance with an enable
checklist. All variables remain in top-level vars.yml.

Done by Sisyphus.

roles/jellyfin/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+- name: Deploy Jellyfin
+  containers.podman.podman_container:
+    image: lscr.io/linuxserver/jellyfin:latest
+    name: jellyfin
+    env:
+      USER_UID: 1000
+      USER_GID: 1000
+      JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io
+    restart_policy: always
+    recreate: true
+    state: started
+    volumes:
+      - /opt/apps/jellyfin/config:/config:z
+      - /opt/apps/jellyfin/tvseries:/data/tvshows:z
+      - /opt/apps/jellyfin/movies:/data/movies:z
+      - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    network:
+      - npm_internal
+    ip: '10.10.0.30'