vaultwarden: sign-ups off by default, and publish on loopback only

SIGNUPS_ALLOWED was hardcoded 'true' in the compose file and turned off by a
separate manual playbook, so every routine run of the deploy - site.yml
included - silently re-opened registration. It is now
vaultwarden_signups_allowed, default false.

The port was published as a bare "8222:80". Docker writes its own iptables
rules ahead of UFW, so Vaultwarden answered plain HTTP on the public
interface, bypassing Caddy and TLS. Now 127.0.0.1:8222; verified closed from
outside.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml

@@ -27,13 +27,16 @@
               container_name: vaultwarden
               restart: unless-stopped
               ports:
-                - "{{ vaultwarden_port }}:80"
+                # Loopback only. Docker writes its own iptables rules AHEAD of
+                # UFW, so a bare "8222:80" was reachable from the internet as
+                # plain HTTP, bypassing Caddy and TLS. Caddy is the only client.
+                - "127.0.0.1:{{ vaultwarden_port }}:80"
               volumes:
                 - ./data:/data
               environment:
                 WEBSOCKET_ENABLED: 'true'
                 DOMAIN: "https://{{ vaultwarden_domain }}"
-                SIGNUPS_ALLOWED: 'true'
+                SIGNUPS_ALLOWED: '{{ vaultwarden_signups_allowed | bool | lower }}'
                 LOG_FILE: /data/vaultwarden.log
 
     - name: Deploy vaultwarden container with docker compose