feat: template pds.env with Ansible-managed config

Reads installer-generated secrets from pds.env and re-templates it with
config from vars/main.yml (S3, SMTP, blob limits, etc.). Secrets are
preserved across runs; only config changes trigger a restart.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

vars/main.yml.example

@@ -6,3 +6,19 @@ pds_admin_email: admin@example.com
 # pds_data_dir must be /pds — the installer enforces this
 pds_data_dir: /pds
 pds_image_tag: "0.4"
+pds_blob_upload_limit: 104857600
+pds_rate_limits_enabled: true
+pds_invite_required: true
+
+# S3 blob storage (uncomment to use instead of disk)
+# pds_blobstore_type: s3
+# pds_blobstore_s3_bucket: my-pds-blobs
+# pds_blobstore_s3_region: us-east-1
+# pds_blobstore_s3_endpoint: https://s3.example.com  # omit for AWS S3
+# pds_blobstore_s3_force_path_style: true
+# pds_blobstore_s3_access_key: CHANGE_ME
+# pds_blobstore_s3_secret_key: CHANGE_ME
+
+# Email (uncomment to enable email verification)
+# pds_email_smtp_url: smtps://username:password@smtp.example.com/
+# pds_email_from_address: admin@example.com