feat: extract raven_subscribe, nginx_frontend, relay into separate Ansible roles

[findias]

Summary

• New role raven_subscribe — standalone deployment of the subscription server, fully decoupled from xray/sing-box playbooks. Supports per-inbound inbound_hosts/inbound_ports overrides so all VLESS protocols route through media.zirgate.com.
• New role nginx_frontend — TLS reverse proxy on EU server (media.zirgate.com). Listens on port 8443 (port 443 is reserved by Xray VLESS Reality). Adds nginx stream TCP passthrough on port 8445 → 127.0.0.1:443 for Reality clients.
• New role relay — nginx reverse proxy on RU VPS (zirgate.com / my.zirgate.com). TCP stream relay on 8444 → EU:8445 routes VLESS Reality through the RU server.
• xray role: removed raven_subscribe vars and tasks (moved to dedicated role); fixed DNS query strategy UseIP → UseIPv4 to prevent IPv6 network is unreachable errors.
• sing-box: updated hysteria2 default port 8443 → 8444 (8443 now used by nginx_frontend).
• raven-subscribe config.j2: added balancer_strategy, balancer_probe_url, balancer_probe_interval fields.
• .gitignore: added **/*_secrets.yml pattern.

Architecture after this PR

Client → zirgate.com:8444 (RU relay TCP) → media.zirgate.com:8445 (EU nginx stream) → 127.0.0.1:443 (Xray Reality)
Client → media.zirgate.com:443 (direct HTTPS) → nginx_frontend:8443 → raven-subscribe:8080
Client → media.zirgate.com:2053 (XHTTP) → Xray XHTTP inbound

Test plan

• Deploy role_nginx_frontend.yml to EU server — nginx listens on 8443, stream proxy on 8445
• Deploy role_relay.yml to RU server — TCP relay 8444 → EU:8445
• Deploy role_raven_subscribe.yml — subscription returns media.zirgate.com addresses
• Verify subscription: curl https://my.zirgate.com/sub/<token> shows address: media.zirgate.com, ports 8445 (Reality) and 2053 (XHTTP)
• Run ./tests/run.sh to validate Ansible render + xray config