ansible: run the asxp.io XMPP server on asxpio-services

ejabberd, apushd and the tackygram gateway ran on the temporary
claude-test-xmpp server, a separate CX23 billed on its own. Move them
to asxpio-services, which has the room now that Fossils is gone, and
manage them like the other stacks.

Compose follows anotherim-server's compose.yaml and
compose.tackygram.yaml with CERTS=files; image versions are variables
so they can be tracked. The TURN and call addresses come from the
host's public IP instead of a hand-edited env file. Secrets, keys and
the certificate stay on the host under /opt/xmpp/state as data and are
covered by the restic backup.

Assisted-by: Claude:opus-5-5

ansible/roles/xmpp/tasks/main.yaml

@@ -0,0 +1,20 @@
+---
+# Compose and settings are managed here. The secrets and keys stay on the
+# host as data, like a game world, and are covered by the restic backup:
+#   state/secrets.env          ejabberd secrets
+#   state/certs/server.pem     TLS certificate (asxp.io, conference., xmpp.)
+#   state/apushd/              push settings and VAPID key
+#   state/tackygram/{env,key}  gateway credentials and master key
+# Data: volumes xmpp_database, xmpp_tackygram.
+- name: Deploy XMPP
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: xmpp
+    service_base_path: "{{ services_base_path }}/xmpp"
+    service_directories:
+      - { path: state, mode: "0700" }
+    service_templates:
+      - { src: docker-compose.yml.j2, dest: docker-compose.yml }
+      - { src: settings.env.j2, dest: settings.env }
+    health_check_port: 5222