Merge pull request 'Release v1.14.0 — monetization launch (E5-E8)' (#237) from development into master

deploy/ansible/roles/common/tasks/main.yml

@@ -213,20 +213,6 @@
   loop:
     - ""
     - config
+    - certs
     - dumps
     - images
-
-# The certs dir holds the reverse-mTLS bot-link keypair, bind-mounted into the gateway (and
-# backend) which run as the distroless nonroot UID 65532 — not the deploy user. The dir must be
-# traversable by "other" (0755) or the nonroot process cannot open the 0644 keypair and crash-loops
-# at startup ("mtls: load server keypair: ... permission denied") — a latent failure that only bites
-# on a container restart (e.g. a host reboot), not while a long-running container holds the keypair
-# in memory. The keys themselves are 0644 by design (see the gateway compose); the host is
-# single-tenant and SSH-access-controlled, so a traversable certs dir adds no meaningful exposure.
-- name: Create the scrabble certs directory (traversable by the nonroot gateway UID)
-  ansible.builtin.file:
-    path: "{{ scrabble_base_dir }}/certs"
-    state: directory
-    owner: "{{ deploy_user }}"
-    group: "{{ deploy_user }}"
-    mode: "0755"