LAN/local deployment support, OS compat, Cloudflare Tunnel

- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN,
  HSTS max-age=0 for self-signed certs, split LAN vs public messages
- Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact
- Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream)
- Module prompts: accept IPs for matrix/cloud/vault/media, hard error
  on email with IP, all_in_one skips certbot email for LAN
- Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name
- OS family guards: ansible_os_family == Debian on all apt tasks
- SSH key path: expanduser().resolve() on user-provided key paths
- Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API
  token — no browser auth needed, creates tunnel + credentials + DNS + systemd

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/all_in_one/main.yml

@@ -25,6 +25,7 @@
           - certbot
           - python3-certbot-nginx
         state: present
+      when: ansible_os_family == "Debian"
 
     - name: Remove default nginx site
       file:
@@ -133,7 +134,7 @@
 
     - name: restart php-fpm
       service:
-        name: php8.2-fpm
+        name: "php{{ php_ver | default('8.2') }}-fpm"
         state: restarted
 
     - name: restart mariadb