LAN/local deployment support, OS compat, Cloudflare Tunnel

- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN,
  HSTS max-age=0 for self-signed certs, split LAN vs public messages
- Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact
- Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream)
- Module prompts: accept IPs for matrix/cloud/vault/media, hard error
  on email with IP, all_in_one skips certbot email for LAN
- Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name
- OS family guards: ansible_os_family == Debian on all apt tasks
- SSH key path: expanduser().resolve() on user-provided key paths
- Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API
  token — no browser auth needed, creates tunnel + credentials + DNS + systemd

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/cloud/tasks/install.yml

@@ -4,19 +4,19 @@
 - name: Install Nextcloud dependencies
   apt:
     name:
-      - php8.2-fpm
-      - php8.2-xml
-      - php8.2-mbstring
-      - php8.2-gd
-      - php8.2-curl
-      - php8.2-zip
-      - php8.2-intl
-      - php8.2-mysql
-      - php8.2-redis
-      - php8.2-apcu
-      - php8.2-imagick
-      - php8.2-bcmath
-      - php8.2-gmp
+      - php-fpm
+      - php-xml
+      - php-mbstring
+      - php-gd
+      - php-curl
+      - php-zip
+      - php-intl
+      - php-mysql
+      - php-redis
+      - php-apcu
+      - php-imagick
+      - php-bcmath
+      - php-gmp
       - mariadb-server
       - redis-server
       - nginx
@@ -27,6 +27,16 @@
       - ca-certificates
     state: present
     update_cache: true
+  when: ansible_os_family == "Debian"
+
+- name: Detect installed PHP version
+  command: php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;'
+  register: _php_ver_result
+  changed_when: false
+
+- name: Set PHP version fact
+  set_fact:
+    php_ver: "{{ _php_ver_result.stdout }}"
 
 - name: Enable and start MariaDB
   service:
@@ -42,7 +52,7 @@
 
 - name: Enable and start PHP-FPM
   service:
-    name: php8.2-fpm
+    name: "php{{ php_ver }}-fpm"
     state: started
     enabled: true