Role ipt-server: migrate piwik.warenform.de.

host_vars follow the current config on the host: add fw_mail_client_ips,
drop fw_blocked_ips_v4 (empty on the host). IPv4 rules unchanged; the old
IPv6 firewall had aborted halfway (policy ACCEPT), it is now complete.
Second run changed=0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

host_vars/piwik.warenform.de/piwik-ipt-server.yml

@@ -20,8 +20,8 @@ munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
 # --- HTTP
 fw_http_server_ips: $ext_1_ip
 
-# --- Block
-fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
 
 # --- Protection / limits
 fw_per_IP_connection_limit: 501