fix: update playbooks read the backup VMID from the registry; drop client-side prune

The *-update.yml playbooks hard-coded the pre-migration VMIDs, so after cutover
the "safety backup" ran against the stopped OLD container. Now the VMID comes
from homelab_services['<svc>'].vmid.

Also removes `--prune-backups keep-all=1` from the vzdump calls: retention is
PBS's job (prune-pbs), and the client-side flag needed Datastore.Modify/Prune
the ansible@pve token does not have, which made vzdump print "Backup ... failed"
and exit non-zero after a successful upload.

gitea-update.yml additionally splits the offsite backup (hosts: gitea) from its
audit (hosts: cloud-pc), matching the profile move into the container.
pve-*.yml imports pass pve_provisioning_enabled: false so the runtime update
path never re-enters container creation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/vaultwarden-update.yml

@@ -24,18 +24,22 @@
 - name: Create and verify Vaultwarden PBS backup before update
   hosts: mini-pc
   gather_facts: false
+  vars:
+    vaultwarden_vmid: "{{ homelab_services['vaultwarden'].vmid }}"
   tasks:
-    - name: Read existing VMID 140 configuration
-      ansible.builtin.command: pct config 140
+    - name: Read existing Vaultwarden VMID configuration
+      ansible.builtin.command: "pct config {{ vaultwarden_vmid }}"
       register: vaultwarden_existing_vmid
       changed_when: false
 
-    - name: Refuse to modify a foreign VMID 140
+    - name: Refuse to modify a foreign Vaultwarden VMID
       ansible.builtin.assert:
         that:
           - vaultwarden_existing_vmid.rc == 0
           - vaultwarden_existing_hostname == 'vaultwarden'
-        fail_msg: VMID 140 already exists and is not the Vaultwarden container.
+        fail_msg: >-
+          VMID {{ vaultwarden_vmid }} from the service registry is not the
+          Vaultwarden container.
       vars:
         vaultwarden_existing_hostname: >-
           {{ vaultwarden_existing_vmid.stdout_lines
@@ -62,13 +66,11 @@
       ansible.builtin.command:
         argv:
           - vzdump
-          - "140"
+          - "{{ vaultwarden_vmid }}"
           - --storage
           - pbs
           - --mode
           - snapshot
-          - --prune-backups
-          - keep-all=1
           - --exclude-path
           - /var/lib/docker/fuse-overlayfs/*/merged
 
@@ -82,6 +84,8 @@
       changed_when: true
 
 - import_playbook: pve-vaultwarden.yml
+  vars:
+    pve_provisioning_enabled: false
 
 - name: Verify Vaultwarden public endpoint after update
   hosts: ru-vps