docs(collection): document all roles and fix metadata drift

Replace ansible-galaxy init placeholders across the collection and
correct documentation that drifted from the code, after a multi-agent
review of every role README against its defaults, tasks and templates.

Collection level:
- README: role table for all 16 roles, requirements and role-ordering
- galaxy.yml: declare community.docker and community.general deps,
  real description/tags/urls; normalize license to MIT-0
- meta/runtime.yml: requires_ansible '>=2.15.0'
- plugins/README: document the homarr_layout filter and
  garage_credentials lookup instead of scaffold boilerplate

Per-role meta/main.yml and README for the placeholder roles
(389ds, authentik, authentik_outpost_ldap, base, collabora, drawio,
garage, homarr, httpbin, keycloak, nextcloud, opencloud, traefik).

Correctness fixes found during review:
- keycloak: wrong domain default, drop invented keycloak_cert_resolver,
  document the provisioning feature
- garage: root_domain is .s3.<first-entry>, not the bare domain
- opnform: jwt/front_api secrets use `openssl rand -hex 32`; align the
  validation fail_msg in tasks/main.yml accordingly
- send: S3 example references garage_s3_domains[0] (was singular)
- opencloud: document required opencloud_wopi_domain

License normalized to MIT-0 across galaxy.yml, role meta and READMEs to
match the SPDX headers.

roles/homarr/README.md

@@ -36,8 +36,10 @@ secrets to version control.**
 | `homarr_admin_password` | strong password | `openssl rand -base64 24` |
 | `homarr_oidc_client_secret` | from your identity provider | — |
 
-The `assert` task at the top of the role will fail fast if the encryption
-key is missing or malformed.
+`homarr_oidc_client_secret` is only required when `oidc` is in
+`homarr_auth_providers`; the role asserts it then. The encryption key is
+always required — the `assert` task at the top of the role fails fast if it
+is missing or malformed.
 
 ## Configurable variables
 
@@ -113,7 +115,7 @@ The filter is invoked once from `tasks/main.yml`:
 ```yaml
 - name: Compute Homarr app layouts
   ansible.builtin.set_fact:
-    homarr_layout: "{{ homarr_apps | homarr_compute_layouts }}"
+    homarr_layout: "{{ homarr_apps | digitalboard.core.homarr_compute_layouts }}"
 ```
 
 This produces a `homarr_layout` fact with two keys, both consumed by
@@ -121,14 +123,14 @@ This produces a `homarr_layout` fact with two keys, both consumed by
 
 | Key | Shape | Purpose |
 |---|---|---|
-| `apps` | list, same order as `homarr_apps` | each entry enriched with `desktop`, `tablet`, `mobile` sub-dicts of `{x, y, w, h}` |
+| `apps` | list, same order as `homarr_apps` | each entry gains `desktop`/`tablet`/`mobile` dicts of `{x, y, w, h}` |
 | `section_height` | dict with `desktop`, `tablet`, `mobile` | minimum height of the parent section so all tiles fit |
 
 The filter signature accepts custom column counts if Homarr ever
 changes the breakpoint widths:
 
 ```jinja
-{{ homarr_apps | homarr_compute_layouts(desktop_cols=12, tablet_cols=8, mobile_cols=4) }}
+{{ homarr_apps | digitalboard.core.homarr_compute_layouts(desktop_cols=12, tablet_cols=8, mobile_cols=4) }}
 ```
 
 To debug a layout without running the full deploy, run the play with
@@ -241,4 +243,8 @@ and lowercase are accepted.
 
 **App tiles overlap.** Check `homarr_apps` for duplicate `id` values.
 The role validates this, but if you bypass the check, the seed will
-still run and Homarr will display only one of the duplicates.
+still run and Homarr will display only one of the duplicates.
+
+## License
+
+MIT-0