DNS & certs refactor:

- Switch certbot flag from MODE_TEST → MODE_DUMMY in dedicated certs
- Add sys-svc-dns defaults for CLOUDFLARE_NAMESERVERS
- Introduce 02_nameservers.yml for NS cleanup + enforce, adjust task ordering (apex now 03_apex.yml)
- Enforce quoting for Bluesky and Mailu TXT records
- Add cleanup of MX/TXT/DMARC/DKIM in Mailu role
- Normalize no_log handling in Nextcloud plugin
- Simplify async conditionals in Collabora role
Conversation: https://chatgpt.com/share/68cd20d8-9ba8-800f-b070-f7294f072c40

roles/sys-svc-dns/tasks/03_apex.yml

@@ -0,0 +1,28 @@
+---
+- name: "Ensure A @ for {{ base_domain }}"
+  community.general.cloudflare_dns:
+    api_token:  "{{ CLOUDFLARE_API_TOKEN }}"
+    zone:       "{{ base_domain }}"
+    type:       A
+    name:       "@"
+    content:    "{{ networks.internet.ip4 }}"
+    proxied:    false
+    ttl:        1
+    state:      present
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
+
+- name: "Ensure AAAA @ for {{ base_domain }} (if IPv6 is global)"
+  community.general.cloudflare_dns:
+    api_token:  "{{ CLOUDFLARE_API_TOKEN }}"
+    zone:       "{{ base_domain }}"
+    type:       AAAA
+    name:       "@"
+    content:    "{{ networks.internet.ip6 }}"
+    proxied:    false
+    ttl:        1
+    state:      present
+  when:
+    - (networks.internet.ip6 | default('') | trim) != ''
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"