docs(collection): document all roles and fix metadata drift

Replace ansible-galaxy init placeholders across the collection and
correct documentation that drifted from the code, after a multi-agent
review of every role README against its defaults, tasks and templates.

Collection level:
- README: role table for all 16 roles, requirements and role-ordering
- galaxy.yml: declare community.docker and community.general deps,
  real description/tags/urls; normalize license to MIT-0
- meta/runtime.yml: requires_ansible '>=2.15.0'
- plugins/README: document the homarr_layout filter and
  garage_credentials lookup instead of scaffold boilerplate

Per-role meta/main.yml and README for the placeholder roles
(389ds, authentik, authentik_outpost_ldap, base, collabora, drawio,
garage, homarr, httpbin, keycloak, nextcloud, opencloud, traefik).

Correctness fixes found during review:
- keycloak: wrong domain default, drop invented keycloak_cert_resolver,
  document the provisioning feature
- garage: root_domain is .s3.<first-entry>, not the bare domain
- opnform: jwt/front_api secrets use `openssl rand -hex 32`; align the
  validation fail_msg in tasks/main.yml accordingly
- send: S3 example references garage_s3_domains[0] (was singular)
- opencloud: document required opencloud_wopi_domain

License normalized to MIT-0 across galaxy.yml, role meta and READMEs to
match the SPDX headers.

roles/traefik/README.md

@@ -54,10 +54,15 @@ common overrides:
 
 ## Dependencies
 
-- Traefik network (`traefik_network`, default `proxy`) must be created
-  by the `base` role or by hand before this role runs.
-- In `dmz` mode, the proxied backend services advertise themselves via
-  the `traefik_services` host_var on each backend host.
+- Run `digitalboard.core.base` first (or otherwise install Docker and the
+  `community.docker` collection); this role manages containers and networks
+  through `community.docker`.
+- The Traefik network (`traefik_network`, default `proxy`) is created by
+  this role (`community.docker.docker_network`, state present), so no
+  pre-creation is required.
+- In `dmz` mode, backend hosts advertise the services to aggregate via the
+  `traefik_dmz_exposed_services` host_var; `traefik_services` defines extra
+  routes directly on the DMZ host (each entry must set `backend_host`).
 
 ## Example playbook