Add global CAPTCHA config and EspoCRM seeder

- Introduce shared CAPTCHA settings and RECAPTCHA_ENABLED/HCAPTCHA_ENABLED flags in group_vars
- Wire reCAPTCHA/hCaptcha credentials into EspoCRM, Keycloak, Listmonk and Nextcloud
- Replace EspoCRM set_flags.php with generic seed_config.php and hook it into entrypoint/env
- Fix run_once handling in sys-ctl-cln-disc-space and minor CSS Jinja spacing issue

https://chatgpt.com/share/692a1d4f-1154-800f-a4ae-bb068aa24a53

roles/web-app-listmonk/config/main.yml

@@ -6,7 +6,7 @@ features:
   central_database:         true
   oidc:                     true
   logout:                   true
-  hcaptcha:                 true
+  hcaptcha:                 "{{ HCAPTCHA_ENABLED | bool }}"
 server:
   domains:
     canonical:
@@ -23,9 +23,13 @@ docker:
     database:
       enabled: true
     listmonk:
-      image:            listmonk/listmonk
-      version:          latest
+      image:              listmonk/listmonk
+      version:            latest
       backup:
         no_stop_required: true
-      name:             listmonk
-      port:             9000
+      name:               listmonk
+      port:               9000
+credentials:
+  hcaptcha:
+    key:    "{{ CAPTCHA.HCAPTCHA.KEY }}"
+    secret: "{{ CAPTCHA.HCAPTCHA.SECRET }}"