Feature/atlas icloudpd migration (#14)

* Design gated Atlas iCloudPD migration target

* Target Atlas iCloudPD photos to Photobook

* Record isolated iCloudPD Photobook ACL validation

* Record Aegis iCloudPD source audit gap

* Verify iCloudPD backup source scope and Borg access

* Record Atlas iCloudPD deployment gate checks

* Pin iCloudPD photo file and directory modes

* Validate inactive iCloudPD Quadlet on Atlas generator

* Keep iCloudPD in Archive and reserve Photobook for Immich

* Prepare guarded Aegis iCloudPD retirement

* Declare inactive Atlas iCloudPD storage and Quadlet

* Retire Aegis iCloudPD from desired state

* Clear retired Aegis iCloudPD failed-unit state

* Remove completed iCloudPD retirement tasks from Aegis

* Record initial Atlas iCloudPD service start

* Manage Atlas iCloudPD config from Vault

* Fix Atlas iCloudPD traceroute startup and config drift

* Use Atlas Vault key for iCloudPD Apple ID

* Add HEIC decoding to Fedora desktops

* Record completed iCloudPD ingestion and remaining recovery checks

ansible/roles/profile_aegis/tasks/main.yml

@@ -13,14 +13,6 @@
     msg: Reboot Aegis to activate the newly layered packages, then rerun the playbook.
   when: aegis_layered_packages_result.needs_reboot | default(false)
 
-- name: Require Aegis iCloudPD Apple ID
-  tags: [aegis, icloudpd]
-  ansible.builtin.assert:
-    that:
-      - aegis_icloudpd_apple_id | length > 0
-    fail_msg: Define vault_aegis_icloudpd_apple_id before applying the Aegis profile.
-  no_log: true
-
 - name: Require completed Aegis network placeholders
   tags: [aegis, dns, firewall, network, services]
   ansible.builtin.assert:
@@ -119,8 +111,6 @@
   loop:
     - /var/lib/adguard/work
     - /var/lib/adguard/conf
-    - /var/lib/icloudpd/data
-    - /var/lib/icloudpd/config
 
 - name: Create Quadlet configuration directory
   tags: [aegis, containers]
@@ -142,12 +132,9 @@
   loop:
     - src: adguardhome.container.j2
       dest: adguardhome.container
-    - src: icloudpd.container.j2
-      dest: icloudpd.container
   loop_control:
     label: "{{ item.dest }}"
-  no_log: "{{ item.dest == 'icloudpd.container' }}"
-  notify: Restart Aegis Quadlet services
+  notify: Restart Aegis AdGuard Quadlet
 
 - name: Create Aegis systemd-resolved configuration directory
   tags: [aegis, adguard, dns, services]
@@ -168,7 +155,7 @@
     mode: "0644"
   notify:
     - Restart Aegis systemd-resolved
-    - Restart Aegis Quadlet services
+    - Restart Aegis AdGuard Quadlet
 
 - name: Point Aegis resolver at the full systemd-resolved configuration
   tags: [aegis, adguard, dns, services]
@@ -361,7 +348,7 @@
     group: root
     mode: "0755"
 
-- name: Enable Aegis Quadlet services and automatic updates
+- name: Enable Aegis AdGuard Quadlet and automatic updates
   tags: [aegis, containers, services]
   ansible.builtin.systemd:
     name: "{{ item }}"
@@ -370,7 +357,6 @@
     daemon_reload: true
   loop:
     - adguardhome.service
-    - icloudpd.service
     - podman-auto-update.timer
   loop_control:
     label: "{{ item }}"