Fix storage_box SSH key installation and deploy ordering

- Always run install-ssh-key (drop unreliable sftp idempotency check
  that was bypassed by SSH agent forwarding)
- Use sshpass -e (env var) instead of -p to avoid shell quoting issues
  with special characters in passwords
- Add -o IdentitiesOnly=yes to prevent agent keys interfering
- Add reachable_externally: true to access_settings (was being reset
  to false on every run)
- Remove storage_box.yml from deploy.yml chain — Ansible loads
  group_vars at startup so storagebox.yml must exist before deploy.yml
- Document storage_box.yml as a prerequisite step in README, CLAUDE.md,
  and setup.sh next steps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

setup.sh

@@ -247,7 +247,9 @@ echo "Next steps:"
 echo "  1. Review $CONFIG"
 echo "  2. Review $VAULT (ansible-vault edit)"
 echo "  3. Review $DNS_CONFIG"
-echo "  4. Deploy:  ansible-playbook playbooks/deploy.yml"
+echo "  4. If restic is enabled, set up the storage box first:"
+echo "      ansible-playbook playbooks/storage_box.yml"
+echo "  5. Deploy:  ansible-playbook playbooks/deploy.yml"
 echo ""
 echo "  If mail is enabled, sync DKIM keys once the server is up:"
 echo "      ansible-playbook playbooks/dkim_sync.yml"