retire Graylog behind a flag, fix Caddy reloads, reap awsddns zombies

Graylog was the worst cost/benefit tenant on this 4-core box: two JVMs plus
MongoDB holding ~1.6 GB resident and ~3% CPU around the clock to store ~3k
messages a day -- about 28 MB across its four live indices. journald already
retains ~25 days of the same logs at its 500M cap, so this costs searchability,
not the logs.

The switch is `graylog_enabled` in inventory rather than a role default,
because three roles read it (common, podman, graylog-config). The disabled
path is an active teardown, not a skipped create: the containers already on
the host keep running and their systemd user units keep restarting them at
boot unless something stops and removes them. fluent-bit follows the same
flag -- with the GELF sink down it would spin retrying a dead 127.0.0.1:12202
and fill the journal it exists to drain -- but only the service state follows,
so re-enabling is a restart rather than a reinstall.

Caddy reloads were silently no-ops. The handler read /etc/caddy/Caddyfile,
which is a single-file bind mount, and podman binds those by inode; the
template module writes a temp file and renames it into place, so every deploy
gave the host file a new inode while the container kept seeing the one it was
created with. Config changes only ever landed when something recreated the
container. {{ caddy_path }}/config is also mounted, as a *directory*, and
directory mounts resolve names at open() time -- so /config/Caddyfile is
always the file Ansible just wrote.

awsddns and its four siblings had accumulated 12 zombies over 30 days of
uptime. The image's PID 1 is busybox crond, which only waitpid()s the job PIDs
it tracks and does no generic orphan reaping, so whenever the run-parts/sh
layer exited before the script it left a permanent <defunct>. init: true puts
catatonit at PID 1 to reap them, and the recreation clears the existing ones.

Also bumps fulfillr and greg-time-bot images.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/roles/podman/templates/caddy/Caddyfile.j2

@@ -238,6 +238,34 @@
 }
 
 # Graylog Logs - {{ logs_server_name }}
+{% if not (graylog_enabled | bool) %}
+# Graylog is disabled (see graylog_enabled in inventories/home/hosts.yml). The
+# vhost is kept rather than dropped so the name keeps resolving and its
+# certificate keeps renewing; both handlers answer 503 instead of proxying to a
+# port nothing is listening on, which would hang and then 502.
+#
+# NOTE: this means the external Lambda that POSTs to /gelf for the
+# `debyltech-api` stream is being turned away. Its events are dropped, not
+# queued -- nothing else records them.
+{{ logs_server_name }} {
+	handle /gelf {
+		respond "Log ingest disabled" 503
+	}
+
+	handle {
+		respond "Graylog is disabled" 503
+	}
+
+	log {
+		output file /var/log/caddy/graylog.log {
+			roll_size {{ caddy_log_roll_size }}
+			roll_keep {{ caddy_log_roll_keep }}
+			roll_keep_for {{ caddy_log_roll_keep_for }}
+		}
+		format json
+	}
+}
+{% else %}
 {{ logs_server_name }} {
 	# GELF HTTP endpoint - open for Lambda (auth via header)
 	# Must come BEFORE ip_restricted_site to allow external access
@@ -283,6 +311,7 @@
 		format json
 	}
 }
+{% endif %}
 
 # ============================================================================
 # COMPLEX CONFIGURATIONS