Add the system cleanup role

Adds ansible-role-cleanup from the MASH project. It can remove superseded
Docker images and stopped containers on every playbook run (unlike
`docker image prune -a`, keeping the images of stopped services), vacuum
old logs, remove paths and, on Debian-based distributions, upgrade
packages and purge old kernels. Everything is off by default.

The role runs after systemd_service_manager, once every service is
running, so the Docker cleanup can tell which images are still needed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

setup.yml

@@ -151,6 +151,11 @@
     - when: devture_systemd_service_manager_enabled | bool
       role: galaxy/systemd_service_manager
 
+    # This role needs to run after the services have been (re)started.
+    # By then, every image the services need has been pulled and is in use by a running container,
+    # so the Docker cleanup can tell which images are still needed and which have been superseded.
+    - role: galaxy/cleanup
+
     # This is pretty much last, because we want it to better serve as a "last known good configuration".
     # See: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2217#issuecomment-1301487601
     - when: devture_playbook_state_preserver_enabled | bool