Add Podman container infrastructure role for containerized services

- Implemented complete Podman infrastructure role following rick-infra patterns
- Minimal installation approach: only install podman, trust Arch dependency management
- Configured with crun runtime for optimal performance and security
- Security-focused: HTTPS-only registries, rootless containers, systemd hardening
- Registry support: docker.io, quay.io, ghcr.io with secure configurations
- Ready for service-specific users with isolated container environments
- Quadlet support for native systemd container management
- Container-to-host networking via bridge networks with host gateway access
- Foundation for future containerized services (Authentik, Nextcloud)
- Maintains rick-infra philosophy: infrastructure provides foundation, apps manage specifics

roles/podman/tasks/main.yml

@@ -0,0 +1,79 @@
+---
+# Podman Infrastructure Role - Simplified Tasks
+
+- name: Update package cache
+  pacman:
+    update_cache: yes
+
+- name: Install crun as OCI runtime (faster than runc)
+  pacman:
+    name: crun
+    state: present
+
+- name: Install Podman container runtime
+  pacman:
+    name: podman
+    state: present
+
+- name: Verify podman installation
+  command: podman --version
+  register: podman_version_check
+  changed_when: false
+
+- name: Create global containers configuration directory
+  file:
+    path: /etc/containers
+    state: directory
+    mode: '0755'
+
+- name: Configure global container registries
+  template:
+    src: registries.conf.j2
+    dest: /etc/containers/registries.conf
+    mode: '0644'
+    backup: yes
+  notify: restart podman
+
+- name: Configure global podman settings
+  template:
+    src: containers.conf.j2
+    dest: /etc/containers/containers.conf
+    mode: '0644'
+    backup: yes
+  notify: restart podman
+
+- name: Enable podman system service (if enabled)
+  systemd:
+    name: podman
+    enabled: "{{ podman_service_enabled }}"
+    state: "{{ podman_service_state }}"
+    daemon_reload: yes
+  when: podman_service_enabled
+
+- name: Test podman functionality
+  command: podman info --format json
+  register: podman_info_result
+  changed_when: false
+
+- name: Verify rootless podman configuration
+  command: podman system info
+  register: podman_system_info
+  changed_when: false
+  failed_when: false
+
+- name: Display Podman infrastructure status
+  debug:
+    msg: |
+      ✅ Podman container infrastructure ready!
+      
+      🐳 Version: {{ podman_version_check.stdout.split()[2] | default('unknown') }}
+      🔒 Security: Rootless container runtime enabled
+      📦 Registries: {{ podman_registries | join(', ') }}
+      🏗️ Storage: {{ 'overlay' if 'overlay' in podman_system_info.stdout else 'system default' }}
+      
+      🚀 Ready for containerized applications!
+      
+      📋 Next Steps:
+      - Applications should create service-specific users
+      - Each user gets isolated container environment
+      - Services deploy quadlet files for systemd integration