Fix fresh-deploy blockers and clean up architecture

- Seed postfix-accounts.cf before mailserver start to satisfy Dovecot's
  requirement for at least one account on first boot
- Add failed_when: false to mail user/alias list tasks (files don't exist
  on first run)
- Add forgejo_runner_version (was undefined); default to 12
- Create /srv/forgejo/data/gitea/conf before deploying app.ini
- Decouple goaccess sync from restic: new enable_goaccess_sync flag with
  its own goaccess_sync_* variables
- Move Docker installation to bootstrap exclusively; rename docker.yml to
  networks.yml (runs docker_network role only)
- Add radicale_password to vault template and setup.sh
- Fix goaccess sync tasks gated on enable_goaccess_sync
- Add upstream bug comment to authorized_key deprecation warning
- Update CLAUDE.md and README.md throughout

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

roles/caddy/templates/Caddyfile.j2

@@ -52,6 +52,11 @@ www.{{ site }} {
 
 {% endfor %}
 {% if enable_mail | default(false) %}
+http://{{ mail_hostname }} {
+	root * /var/www/acme
+	file_server
+}
+
 {{ webmail_domain }} {
 	import access_log
 	reverse_proxy rainloop:{{ rainloop_port }}

roles/caddy/templates/compose.yml.j2

@@ -19,6 +19,7 @@ services:
       - /srv/caddy/config:/config
       - /srv/caddy/sites:/srv/sites:ro
       - /srv/goaccess/reports:/srv/goaccess/reports:ro
+      - /var/www/acme:/var/www/acme:ro
     environment:
 {% if enable_goaccess | default(true) %}
       GOACCESS_USER: "{{ goaccess_user }}"