Move mail bootstrap out of Ansible

Disable automatic iCloud keyring initialization by default and add a repo-local bootstrap script that reads .mbsyncrc, stores mail secrets in GNOME Keyring, guides Proton Bridge certificate export, and initializes mail sync/indexing.

ansible/inventory/group_vars/desktop.yml

@@ -1,4 +1,6 @@
 ---
+desktop_manage_icloud_keyring: false
+
 profile_packages:
   - i3
   - i3blocks