refactor: split monolithic playbook into 9 focused ansible roles

Refactored the single ansible-playbook.yml into granular roles under roles/:
- packages: dnf update + package installs
- directories: /opt/apps/* directory creation
- sysctl: ip_forward, src_valid_mark, vm.max_map_count tuning
- network: npm_internal podman network
- wireguard: kernel module, wg-easy container, nftables hook patching
- npm: Nginx Proxy Manager container
- gitea: Gitea container
- jellyfin: Jellyfin container
- wazuh: cert generation + indexer/manager/dashboard containers

Top-level playbook is now a role dispatcher with image pre-pull kept
upfront. n8n deployment kept as commented-out guidance with an enable
checklist. All variables remain in top-level vars.yml.

Done by Sisyphus.

roles/network/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Create internal podman network
+  containers.podman.podman_network:
+    name: npm_internal
+    ip_range: 10.10.0.128/25
+    subnet: 10.10.0.0/24
+    gateway: 10.10.0.1
+    state: present