Add global CAPTCHA config and EspoCRM seeder

- Introduce shared CAPTCHA settings and RECAPTCHA_ENABLED/HCAPTCHA_ENABLED flags in group_vars
- Wire reCAPTCHA/hCaptcha credentials into EspoCRM, Keycloak, Listmonk and Nextcloud
- Replace EspoCRM set_flags.php with generic seed_config.php and hook it into entrypoint/env
- Fix run_once handling in sys-ctl-cln-disc-space and minor CSS Jinja spacing issue

https://chatgpt.com/share/692a1d4f-1154-800f-a4ae-bb068aa24a53

roles/web-app-listmonk/schema/main.yml

@@ -3,13 +3,3 @@ credentials:
     description: "Initial password for the Listmonk administrator account"
     algorithm: "sha256"
     validation: "^[a-f0-9]{64}$"
-
-  hcaptcha_site_key:
-    description: "Public site key used by Listmonk to render hCaptcha"
-    algorithm: "plain"
-    validation: "^[0-9a-zA-Z_-]{32,}$"
-
-  hcaptcha_secret:
-    description: "Private hCaptcha secret key for server-side verification"
-    algorithm: "plain"
-    validation: "^[0-9a-zA-Z_-]{32,}$"