refactor(dns): unify Cloudflare + Hetzner handling across roles

- replaced CERTBOT_DNS_API_TOKEN with CLOUDFLARE_API_TOKEN everywhere
- introduced generic sys-dns-cloudflare-records role for managing DNS records
- added sys-dns-hetzner-rdns role with both Cloud (hcloud) and Robot API flavors
- updated Mailu role to:
  - generate DKIM before DNS setup
  - delegate DNS + rDNS records to the new generic roles
- removed legacy per-role Cloudflare vars (MAILU_CLOUDFLARE_API_TOKEN)
- extended group vars with HOSTING_PROVIDER for rDNS flavor decision
- added hetzner.hcloud collection to requirements

This consolidates DNS management into reusable roles,
supports both Cloudflare and Hetzner providers,
and standardizes variable naming across the project.

roles/web-app-mailu/tasks/02_create-user.yml

@@ -0,0 +1,29 @@
+- name: "Ensure Mailu user '{{ mailu_user_key }};{{ mailu_user_name }}@{{ MAILU_DOMAIN }}'' exists"
+  command: >
+    docker compose exec admin flask mailu {{ mailu_action }}
+      {{ mailu_user_name }} {{ MAILU_DOMAIN }} '{{ mailu_password }}'
+  args:
+    chdir: "{{ MAILU_DOCKER_DIR }}"
+  register: mailu_user_result
+  failed_when: >
+    mailu_user_result.rc != 0 and
+    (
+      "exists, not created" not in mailu_user_result.stderr and
+      "Duplicate entry"   not in mailu_user_result.stderr
+    )
+  changed_when: mailu_user_result.rc == 0
+  when: "'mail-bot' in item.value.roles or 'administrator' in item.value.roles"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "Change password for user '{{ mailu_user_key }};{{ mailu_user_name }}@{{ MAILU_DOMAIN }}'"
+  command: >
+    docker compose exec admin flask mailu password
+      {{ mailu_user_name }} {{ MAILU_DOMAIN }} '{{ mailu_password }}'
+  args:
+    chdir: "{{ MAILU_DOCKER_DIR }}"
+  when: "'mail-bot' in item.value.roles or 'administrator' in item.value.roles"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "Create Mailu API Token for {{ mailu_user_name }}"
+  include_tasks: 03_create-token.yml
+  when: "{{ 'mail-bot' in item.value.roles }}"