feat(semaphore): rewrite role with rootful Podman Quadlet + PostgreSQL

Complete rewrite of the semaphore role. Supersedes three prior
iterations whose admin-user-creation logic was unreliable across
Semaphore CLI versions.

Architecture:
  - Rootful Podman Quadlet under /etc/containers/systemd/
  - Separate PostgreSQL 16-alpine container on a user-defined
    podman network (semaphore-net)
  - Named volumes for both data stores (semaphore_data,
    semaphore_postgres_data) so container recreation is
    non-destructive
  - Pinned image tags: semaphoreui/semaphore:v2.18.5-ansible2.16.5
    and postgres:16-alpine
  - Post-deploy HTTP health check fails the playbook if Semaphore
    doesn't respond on /api/ping within ~60s

Admin user creation remains intentionally manual after first deploy;
the role README documents the exact podman exec command.

Removes the duplicate deploy_semaphore.yml and the now-unneeded
cleanup_semaphore.yml; day1_deploy_semaphore.yml is the canonical
entry point.

ansible/roles/semaphore/tasks/postgres.yml

@@ -0,0 +1,35 @@
+---
+# ============================================================================
+# PostgreSQL container (Quadlet)
+# ============================================================================
+
+- name: Deploy PostgreSQL Quadlet
+  ansible.builtin.template:
+    src: semaphore-postgres.container.j2
+    dest: "{{ semaphore_quadlet_dir }}/{{ semaphore_postgres_container_name }}.container"
+    owner: root
+    group: root
+    mode: "0644"
+  register: postgres_quadlet
+
+- name: Reload systemd to pick up Quadlet changes
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when: postgres_quadlet.changed
+
+- name: Ensure PostgreSQL container is started and enabled
+  ansible.builtin.systemd:
+    name: "{{ semaphore_postgres_container_name }}.service"
+    state: started
+    enabled: true
+
+- name: Wait for PostgreSQL to accept connections
+  ansible.builtin.command:
+    cmd: >-
+      podman exec {{ semaphore_postgres_container_name }}
+      pg_isready -U {{ semaphore_db_user }} -d {{ semaphore_db_name }}
+  register: pg_ready
+  until: pg_ready.rc == 0
+  retries: 30
+  delay: 2
+  changed_when: false