ansible: run the asxp.io XMPP server on asxpio-services

ejabberd, apushd and the tackygram gateway ran on the temporary
claude-test-xmpp server, a separate CX23 billed on its own. Move them
to asxpio-services, which has the room now that Fossils is gone, and
manage them like the other stacks.

Compose follows anotherim-server's compose.yaml and
compose.tackygram.yaml with CERTS=files; image versions are variables
so they can be tracked. The TURN and call addresses come from the
host's public IP instead of a hand-edited env file. Secrets, keys and
the certificate stay on the host under /opt/xmpp/state as data and are
covered by the restic backup.

Assisted-by: Claude:opus-5-5

ansible/roles/xmpp/templates/docker-compose.yml.j2

@@ -0,0 +1,54 @@
+# Managed by Ansible (role xmpp). After compose.yaml and
+# compose.tackygram.yaml of anotherim-server, CERTS=files.
+services:
+  ejabberd:
+    image: dev.another.im/another-im/anotherim-server:{{ xmpp_ejabberd_version }}
+    env_file:
+      - settings.env
+      - state/secrets.env
+    ports:
+      - "5222:5222"                   # clients, STARTTLS
+      - "5223:5223"                   # clients, direct TLS
+      - "5269:5269"                   # other servers
+      - "5443:5443"                   # WebSocket, host-meta
+      - "8448:8448"                   # Matrix federation
+      - "3478:3478/udp"               # STUN and TURN
+      - "3478:3478/tcp"
+      - "49160-49199:49160-49199/udp" # TURN relay
+      - "7777:7777"                   # SOCKS5 bytestreams proxy
+      - "{{ xmpp_tackygram_call_ports }}:{{ xmpp_tackygram_call_ports }}/udp" # gateway calls
+    volumes:
+      - database:/opt/ejabberd/database
+      - logs:/opt/ejabberd/logs
+      - ./state/certs:/opt/ejabberd/conf/certs:ro
+    restart: unless-stopped
+
+  # Push App Server and Telegram gateway share ejabberd's network
+  # namespace: they reach its component port on 127.0.0.1 only.
+  apushd:
+    image: dev.another.im/another-im/apushd:{{ xmpp_apushd_version }}
+    network_mode: service:ejabberd
+    depends_on: [ejabberd]
+    volumes:
+      - ./state/apushd:/etc/apushd:ro
+    restart: unless-stopped
+
+  tackygram:
+    image: dev.another.im/another-im/tackygram:{{ xmpp_tackygram_version }}
+    network_mode: service:ejabberd
+    depends_on: [ejabberd]
+    env_file:
+      - state/tackygram/env
+    environment:
+      CREDENTIALS_DIRECTORY: /run/credentials
+      TACKYGRAM_CALL_IP: "{{ public_ip }}"
+      TACKYGRAM_CALL_PORTS: "{{ xmpp_tackygram_call_ports }}"
+    volumes:
+      - tackygram:/var/lib/tackygram
+      - ./state/tackygram/key:/run/credentials/gateway-key:ro
+    restart: unless-stopped
+
+volumes:
+  database:
+  logs:
+  tackygram: