Add global CAPTCHA config and EspoCRM seeder

- Introduce shared CAPTCHA settings and RECAPTCHA_ENABLED/HCAPTCHA_ENABLED flags in group_vars
- Wire reCAPTCHA/hCaptcha credentials into EspoCRM, Keycloak, Listmonk and Nextcloud
- Replace EspoCRM set_flags.php with generic seed_config.php and hook it into entrypoint/env
- Fix run_once handling in sys-ctl-cln-disc-space and minor CSS Jinja spacing issue

https://chatgpt.com/share/692a1d4f-1154-800f-a4ae-bb068aa24a53

roles/web-app-keycloak/config/main.yml

@@ -7,7 +7,7 @@ features:
   desktop:            true
   ldap:               true
   central_database:   true
-  recaptcha:          true
+  recaptcha:          "{{ RECAPTCHA_ENABLED | bool }}"
 
   # Doesn't make sense to activate logout page for keycloak, because the logout page 
   # anyhow should be included via iframe in keycloak.
@@ -45,12 +45,10 @@ docker:
       pids_limit:       1024
     database:
       enabled: true
-
 credentials:
   recaptcha:
-    website_key:    "" # Required if you enabled recaptcha:
-    secret_key:     ""  # Required if you enabled recaptcha:
-
+    key:  "{{ CAPTCHA.RECAPTCHA.KEY }}"
+    secret:   "{{ CAPTCHA.RECAPTCHA.SECRET }}"
 accounts:
   bootstrap:
     username: "administrator"