refactor: split monolithic playbook into 9 focused ansible roles

Refactored the single ansible-playbook.yml into granular roles under roles/:
- packages: dnf update + package installs
- directories: /opt/apps/* directory creation
- sysctl: ip_forward, src_valid_mark, vm.max_map_count tuning
- network: npm_internal podman network
- wireguard: kernel module, wg-easy container, nftables hook patching
- npm: Nginx Proxy Manager container
- gitea: Gitea container
- jellyfin: Jellyfin container
- wazuh: cert generation + indexer/manager/dashboard containers

Top-level playbook is now a role dispatcher with image pre-pull kept
upfront. n8n deployment kept as commented-out guidance with an enable
checklist. All variables remain in top-level vars.yml.

Done by Sisyphus.

roles/sysctl/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+- name: Enable IP forwarding on host
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: '1'
+    sysctl_set: true
+    state: present
+
+- name: Enable source valid mark on host
+  ansible.posix.sysctl:
+    name: net.ipv4.conf.all.src_valid_mark
+    value: '1'
+    sysctl_set: true
+    state: present
+    reload: true
+
+- name: Raise vm.max_map_count for Wazuh indexer
+  ansible.posix.sysctl:
+    name: vm.max_map_count
+    value: '262144'
+    sysctl_set: true
+    state: present
+    reload: true