fix: update playbooks read the backup VMID from the registry; drop client-side prune

The *-update.yml playbooks hard-coded the pre-migration VMIDs, so after cutover
the "safety backup" ran against the stopped OLD container. Now the VMID comes
from homelab_services['<svc>'].vmid.

Also removes `--prune-backups keep-all=1` from the vzdump calls: retention is
PBS's job (prune-pbs), and the client-side flag needed Datastore.Modify/Prune
the ansible@pve token does not have, which made vzdump print "Backup ... failed"
and exit non-zero after a successful upload.

gitea-update.yml additionally splits the offsite backup (hosts: gitea) from its
audit (hosts: cloud-pc), matching the profile move into the container.
pve-*.yml imports pass pve_provisioning_enabled: false so the runtime update
path never re-enters container creation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/gitea-update.yml

@@ -1,6 +1,6 @@
 ---
 - name: Create and verify Gitea backup before update
-  hosts: cloud-pc
+  hosts: gitea
   gather_facts: false
   tasks:
     - name: Create a fresh Gitea offsite backup
@@ -12,6 +12,10 @@
           - homelab-restic-offsite-gitea.service
       changed_when: true
 
+- name: Run Gitea backup audit
+  hosts: cloud-pc
+  gather_facts: false
+  tasks:
     - name: Run Gitea offsite backup audit
       ansible.builtin.command:
         argv:
@@ -22,6 +26,8 @@
       changed_when: true
 
 - import_playbook: pve-gitea.yml
+  vars:
+    pve_provisioning_enabled: false
 
 - name: Verify Gitea public endpoints after update
   hosts: ru-vps