refactor(dns): unify Cloudflare + Hetzner handling across roles

- replaced CERTBOT_DNS_API_TOKEN with CLOUDFLARE_API_TOKEN everywhere
- introduced generic sys-dns-cloudflare-records role for managing DNS records
- added sys-dns-hetzner-rdns role with both Cloud (hcloud) and Robot API flavors
- updated Mailu role to:
  - generate DKIM before DNS setup
  - delegate DNS + rDNS records to the new generic roles
- removed legacy per-role Cloudflare vars (MAILU_CLOUDFLARE_API_TOKEN)
- extended group vars with HOSTING_PROVIDER for rDNS flavor decision
- added hetzner.hcloud collection to requirements

This consolidates DNS management into reusable roles,
supports both Cloudflare and Hetzner providers,
and standardizes variable naming across the project.

roles/srv-web-7-7-letsencrypt/tasks/01_set-caa-records.yml

@@ -1,14 +1,14 @@
 ---
 
-- name: "Validate CERTBOT_DNS_API_TOKEN"
+- name: "Validate CLOUDFLARE_API_TOKEN"
   fail:
     msg: >
-      The variable "CERTBOT_DNS_API_TOKEN" must be defined and cannot be empty!
-  when: (CERTBOT_DNS_API_TOKEN | default('') | trim) == ''
+      The variable "CLOUDFLARE_API_TOKEN" must be defined and cannot be empty!
+  when: (CLOUDFLARE_API_TOKEN | default('') | trim) == ''
 
 - name: "Ensure all CAA records are present"
   community.general.cloudflare_dns:
-    api_token: "{{ CERTBOT_DNS_API_TOKEN }}"
+    api_token: "{{ CLOUDFLARE_API_TOKEN }}"
     zone:     "{{ item.0 }}"
     record:   "@"
     type:     CAA