fix(docs): address issue #824 deployment documentation gaps

Closes #824 (closed) (partial — documentation fixes only)

Context

Issue #824 (closed) reported 6 findings from a new-deployer review of the Ansible playbook and deployment docs. After investigation:

• Finding 1 (compose overwrite bug) — already fixed
• Finding 6 (NODE_TLS gap) — already fixed
• Finding 2 (KEYCLOAK_URL public proxy) — by-design, not a bug (see rationale below)
• Findings 3, 4, 5 — real documentation gaps → fixed in this MR

Changes

3 — Keycloak SMTP troubleshooting entry

Added troubleshooting entry in Ansible README for the cryptic Invalid sender address 'null' error that occurs when EMAIL_FROM is empty. The smtpServer block in the Keycloak realm template is unconditional.

4 — Manual Swarm deploy guide: add variable resolution

Fixed 4 locations in docs/docker-swarm-setup.md where docker stack deploy -c docker-compose.yaml was documented. docker stack deploy does NOT substitute ${VAR} from environment — services crash with unresolved literals. Added docker compose config resolution step with explanatory note.

5 — Self-signed cert decision matrix in Ansible README

Ported the self-signed certificate decision matrix from docs/docker-compose-setup.md to the Ansible README, mapping Ansible variable names to their env var counterparts.

Why not 2 (KEYCLOAK_URL)

The backend`s JWT validation flow requires the public URL for OIDC discovery:

1. Backend fetches discovery from KEYCLOAK_URL → gets issuer + jwks_uri
2. jwtVerify(token, jwks, { issuer: unverifiedIss }) validates tokens iss against the discoverys issuer
3. If KEYCLOAK_URL were changed to http://keycloak:8080, discovery returns issuer: http://keycloak:8080/realms/... but tokens carry iss: https://public/realms/... → mismatch → every JWT rejected → 401

The current design is intentional. docker-compose.yaml has an explicit comment: "Keycloak OIDC discovery — must use the public URL (via NGINX proxy), not the internal Docker URL, so the issuer matches the JWT`s iss claim." The ~1.5s latency claim is unverified.