ntfy-emergency-app, vaultwarden, forgejo: use the caddy_site role

The plain reverse_proxy shape. All three removed a byte-identical 23-line
block (verified by md5 of the diff with the service name normalised) and
gained the same 7-line include_role call. The caddy_sites_dir self-reference
goes with it.

Verified in check mode, nothing applied to the hosts yet:
  - ntfy-emergency-app: site task ok, changed=0
  - vaultwarden: site task ok; the one changed task is a pre-existing
    always-restarts fail2ban step, identical before the edit
  - forgejo: check mode cannot run this playbook at all - get_url does not
    download in check mode so the next task fails on "Source /tmp/forgejo not
    found". Confirmed identical before the edit. Covered instead by the
    Stage 2 dry-run, which ran the role against vipy with forgejo's real
    parameters and reported ok/unchanged.

All 14 site files on all 3 hosts still byte-identical. Real runs for these
three are still outstanding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml

@@ -8,7 +8,6 @@
     - ./ntfy_emergency_app_vars.yml
   vars:
     ntfy_emergency_app_subdomain: "{{ subdomains.ntfy_emergency_app }}"
-    caddy_sites_dir: "{{ caddy_sites_dir }}"
     ntfy_emergency_app_domain: "{{ ntfy_emergency_app_subdomain }}.{{ root_domain }}"
     ntfy_service_domain: "{{ subdomains.ntfy }}.{{ root_domain }}"
     ntfy_emergency_app_ntfy_url: "https://{{ ntfy_service_domain }}"
@@ -49,35 +48,13 @@
       args:
         chdir: "{{ ntfy_emergency_app_dir }}"
 
-    - name: Ensure Caddy sites-enabled directory exists
-      file:
-        path: "{{ caddy_sites_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Ensure Caddyfile includes import directive for sites-enabled
-      lineinfile:
-        path: /etc/caddy/Caddyfile
-        line: 'import sites-enabled/*'
-        insertafter: EOF
-        state: present
-        backup: yes
-
-    - name: Create Caddy reverse proxy configuration for ntfy-emergency-app
-      copy:
-        dest: "{{ caddy_sites_dir }}/ntfy-emergency-app.conf"
-        content: |
-          {{ ntfy_emergency_app_domain }} {
-              reverse_proxy localhost:{{ ntfy_emergency_app_port }}
-          }
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Reload Caddy to apply new config
-      command: systemctl reload caddy
+    - name: Publish ntfy-emergency-app through Caddy
+      ansible.builtin.include_role:
+        name: caddy_site
+      vars:
+        caddy_site_name: ntfy-emergency-app
+        caddy_site_domain: "{{ ntfy_emergency_app_domain }}"
+        caddy_site_upstream: "localhost:{{ ntfy_emergency_app_port }}"
 
     # ═════════════════════════════════════════════════════════════════════════
     # DEPRECATED — Uptime Kuma was decommissioned on 2026-09-11.