refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/roles/gitea/templates/env.j2

@@ -0,0 +1,12 @@
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/roles/gitea/templates/env.j2
+# DESCRIPTION: Environment file for Gitea Docker Compose stack.
+#              Populated from Ansible Vault at deploy time.
+# ------------------------------------------------------------------------------
+
+DATABASE_PASSWORD={{ gitea_db_password }}
+
+# OIDC auto-registration (Gitea reads these at runtime)
+GITEA__oauth2__ENABLE_AUTO_REGISTRATION=true
+GITEA__oauth2__UPDATE_AVATAR=true
+GITEA__oauth2__ACCOUNT_LINKING=login