fix(ansible): Prevent Traefik and Gitea restart loops

- Set traefik_auto_restart: false in group_vars to prevent automatic restarts after config deployment
- Set traefik_ssl_restart: false to prevent automatic restarts during SSL certificate setup
- Set gitea_auto_restart: false to prevent automatic restarts when healthcheck fails
- Modify traefik/tasks/ssl.yml to only restart if explicitly requested or acme.json was created
- Modify traefik/tasks/config.yml to respect traefik_auto_restart flag
- Modify gitea/tasks/restart.yml to respect gitea_auto_restart flag
- Add verify-traefik-fix.yml playbook to monitor Traefik stability

This fixes the issue where Traefik was restarting every minute due to
automatic restart mechanisms triggered by config deployments and health checks.
The restart loops caused 504 Gateway Timeouts for Gitea and other services.

Fixes: Traefik restart loop causing service unavailability

deployment/ansible/inventory/group_vars/production/vars.yml

@@ -0,0 +1,110 @@
+---
+# Production Deployment - Centralized Variables
+# These variables are used across all playbooks
+
+# System Maintenance
+system_update_packages: true
+system_apt_upgrade: dist
+system_enable_unattended_upgrades: true
+system_enable_unattended_reboot: false
+system_unattended_reboot_time: "02:00"
+system_enable_unattended_timer: true
+system_enable_docker_prune: false
+
+# Deployment Paths
+deploy_user_home: "/home/deploy"
+stacks_base_path: "/home/deploy/deployment/stacks"
+postgresql_production_stack_path: "{{ stacks_base_path }}/postgresql-production"
+app_stack_path: "{{ stacks_base_path }}/production"
+backups_path: "{{ deploy_user_home }}/deployment/backups"
+
+# Docker Registry
+docker_registry: "localhost:5000"
+docker_registry_url: "localhost:5000"
+docker_registry_external: "registry.michaelschiemer.de"
+docker_registry_username_default: "admin"
+# docker_registry_password_default should be set in vault as vault_docker_registry_password
+# If not using vault, override via -e docker_registry_password_default="your-password"
+docker_registry_password_default: ""
+registry_auth_path: "{{ stacks_base_path }}/registry/auth"
+
+# Application Configuration
+app_name: "framework"
+app_domain: "michaelschiemer.de"
+app_image: "{{ docker_registry }}/{{ app_name }}"
+app_image_external: "{{ docker_registry_external }}/{{ app_name }}"
+
+# Domain Configuration
+gitea_domain: "git.michaelschiemer.de"
+
+# Email Configuration
+mail_from_address: "noreply@{{ app_domain }}"
+acme_email: "kontakt@{{ app_domain }}"
+
+# SSL Certificate Domains
+ssl_domains:
+  - "{{ gitea_domain }}"
+  - "{{ app_domain }}"
+
+# Health Check Configuration
+health_check_url: "https://{{ app_domain }}/health"
+health_check_retries: 10
+health_check_delay: 10
+
+# Rollback Configuration
+max_rollback_versions: 5
+rollback_timeout: 300
+
+# Wait Timeouts
+wait_timeout: 60
+
+# Git Configuration (for sync-code.yml)
+git_repository_url_default: "https://{{ gitea_domain }}/michael/michaelschiemer.git"
+git_branch_default: "main"
+git_token: "{{ vault_git_token | default('') }}"
+git_username: "{{ vault_git_username | default('') }}"
+git_password: "{{ vault_git_password | default('') }}"
+
+# Database Configuration
+db_user_default: "postgres"
+db_name_default: "michaelschiemer"
+db_host_default: "postgres-production"
+
+# MinIO Object Storage Configuration
+minio_root_user: "{{ vault_minio_root_user | default('minioadmin') }}"
+minio_root_password: "{{ vault_minio_root_password | default('') }}"
+minio_api_domain: "minio-api.michaelschiemer.de"
+minio_console_domain: "minio.michaelschiemer.de"
+
+# WireGuard Configuration
+wireguard_interface: "wg0"
+wireguard_config_path: "/etc/wireguard"
+wireguard_port_default: 51820
+wireguard_network_default: "10.8.0.0/24"
+wireguard_server_ip_default: "10.8.0.1"
+wireguard_enable_ip_forwarding: true
+wireguard_config_file: "{{ wireguard_config_path }}/{{ wireguard_interface }}.conf"
+wireguard_private_key_file: "{{ wireguard_config_path }}/{{ wireguard_interface }}_private.key"
+wireguard_public_key_file: "{{ wireguard_config_path }}/{{ wireguard_interface }}_public.key"
+wireguard_client_configs_path: "{{ wireguard_config_path }}/clients"
+
+# WireGuard DNS Configuration
+# DNS server for VPN clients (points to VPN server IP)
+# This ensures internal services are resolved to VPN IPs
+wireguard_dns_servers:
+  - "{{ wireguard_server_ip_default }}"
+
+# Traefik Configuration
+# Disable automatic restarts after config deployment to prevent restart loops
+# Set to true only when explicitly needed (e.g., after major config changes)
+traefik_auto_restart: false
+
+# Traefik SSL Configuration
+# Disable automatic restarts during SSL certificate setup to prevent restart loops
+traefik_ssl_restart: false
+
+# Gitea Auto-Restart Configuration
+# Set to false to prevent automatic restarts when healthcheck fails
+# This prevents restart loops when Gitea is temporarily unavailable (e.g., during Traefik restarts)
+# Set to true only when explicitly needed for remediation
+gitea_auto_restart: false