LAN/local deployment support, OS compat, Cloudflare Tunnel

- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN,
  HSTS max-age=0 for self-signed certs, split LAN vs public messages
- Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact
- Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream)
- Module prompts: accept IPs for matrix/cloud/vault/media, hard error
  on email with IP, all_in_one skips certbot email for LAN
- Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name
- OS family guards: ansible_os_family == Debian on all apt tasks
- SSH key path: expanduser().resolve() on user-provided key paths
- Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API
  token — no browser auth needed, creates tunnel + credentials + DNS + systemd

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/matrix/tasks/element.yml

@@ -5,6 +5,7 @@
   apt:
     name: nginx
     state: present
+  when: ansible_os_family == "Debian"
 
 - name: Create Element Web directory
   file:

phantom/playbooks/matrix/tasks/nginx.yml

@@ -82,7 +82,11 @@
           ssl_session_tickets off;
 
           # Security headers
+          {% if _is_selfsigned | default(false) | bool %}
+          add_header Strict-Transport-Security "max-age=0" always;
+          {% else %}
           add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+          {% endif %}
           add_header X-Frame-Options "SAMEORIGIN" always;
           add_header X-Content-Type-Options "nosniff" always;
           add_header X-XSS-Protection "1; mode=block" always;

phantom/playbooks/matrix/tasks/synapse.yml

@@ -16,6 +16,7 @@
       - gnupg
       - lsb-release
     state: present
+  when: ansible_os_family == "Debian"
 
 - name: Add Matrix Synapse GPG key and repository
   shell: |