Add global CAPTCHA config and EspoCRM seeder

- Introduce shared CAPTCHA settings and RECAPTCHA_ENABLED/HCAPTCHA_ENABLED flags in group_vars
- Wire reCAPTCHA/hCaptcha credentials into EspoCRM, Keycloak, Listmonk and Nextcloud
- Replace EspoCRM set_flags.php with generic seed_config.php and hook it into entrypoint/env
- Fix run_once handling in sys-ctl-cln-disc-space and minor CSS Jinja spacing issue

https://chatgpt.com/share/692a1d4f-1154-800f-a4ae-bb068aa24a53

group_vars/all/00_general.yml

@@ -88,3 +88,15 @@ RBAC:
   GROUP:
     NAME:   "/roles"  # Name of the group which holds the RBAC roles
     CLAIM:  "groups"  # Name of the claim containing the RBAC groups
+
+# You need to set both keys to enable them
+CAPTCHA:
+  RECAPTCHA:
+    KEY:    "" 
+    SECRET: ""
+  HCAPTCHA:
+    KEY:    "" 
+    SECRET: ""
+
+RECAPTCHA_ENABLED: "{{ (CAPTCHA.RECAPTCHA.KEY | length > 0) and (CAPTCHA.RECAPTCHA.SECRET | length > 0) }}"
+HCAPTCHA_ENABLED:  "{{ (CAPTCHA.HCAPTCHA.KEY | length > 0) and (CAPTCHA.HCAPTCHA.SECRET | length > 0) }}"