feat: template pds.env with Ansible-managed config

Reads installer-generated secrets from pds.env and re-templates it with
config from vars/main.yml (S3, SMTP, blob limits, etc.). Secrets are
preserved across runs; only config changes trigger a restart.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

templates/pds.env.j2

@@ -0,0 +1,35 @@
+PDS_HOSTNAME={{ pds_hostname }}
+PDS_JWT_SECRET={{ pds_jwt_secret }}
+PDS_ADMIN_PASSWORD={{ pds_admin_password }}
+PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX={{ pds_plc_rotation_key }}
+PDS_DATA_DIRECTORY={{ pds_data_dir }}
+{% if pds_blobstore_type is defined and pds_blobstore_type == "s3" %}
+PDS_BLOBSTORE_S3_BUCKET={{ pds_blobstore_s3_bucket }}
+PDS_BLOBSTORE_S3_REGION={{ pds_blobstore_s3_region }}
+{% if pds_blobstore_s3_endpoint is defined %}
+PDS_BLOBSTORE_S3_ENDPOINT={{ pds_blobstore_s3_endpoint }}
+{% endif %}
+{% if pds_blobstore_s3_force_path_style is defined %}
+PDS_BLOBSTORE_S3_FORCE_PATH_STYLE={{ pds_blobstore_s3_force_path_style | lower }}
+{% endif %}
+PDS_BLOBSTORE_S3_ACCESS_KEY_ID={{ pds_blobstore_s3_access_key }}
+PDS_BLOBSTORE_S3_SECRET_ACCESS_KEY={{ pds_blobstore_s3_secret_key }}
+{% else %}
+PDS_BLOBSTORE_DISK_LOCATION={{ pds_data_dir }}/blocks
+{% endif %}
+PDS_BLOB_UPLOAD_LIMIT={{ pds_blob_upload_limit }}
+PDS_DID_PLC_URL=https://plc.directory
+PDS_BSKY_APP_VIEW_URL=https://api.bsky.app
+PDS_BSKY_APP_VIEW_DID=did:web:api.bsky.app
+PDS_REPORT_SERVICE_URL=https://mod.bsky.app
+PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac
+PDS_CRAWLERS=https://bsky.network
+LOG_ENABLED=true
+PDS_RATE_LIMITS_ENABLED={{ pds_rate_limits_enabled | lower }}
+PDS_INVITE_REQUIRED={{ pds_invite_required | lower }}
+{% if pds_email_smtp_url is defined %}
+PDS_EMAIL_SMTP_URL={{ pds_email_smtp_url }}
+{% endif %}
+{% if pds_email_from_address is defined %}
+PDS_EMAIL_FROM_ADDRESS={{ pds_email_from_address }}
+{% endif %}