refactor: drop shared-service meta dependencies from service roles

podman, postgres, valkey, and nginx are shared services deployed once
per host. Declaring them in meta/main.yml re-ran them on every service
deploy, adding significant time to targeted runs. Playbooks now list
shared services first (tagged 'infra') and every role entry carries a
group tag plus its own name, so '--tags <role>' deploys just that role.

Roles still fail fast when a shared service is missing (password
asserts, postgresql tasks). Prerequisites are documented in role
READMEs. CLAUDE.md updated to reflect the new convention.

roles/immich/README.md

@@ -2,6 +2,10 @@
 
 This Ansible role deploys [Immich](https://immich.app/) - a high performance self-hosted photo and video management solution - using Podman with k8s files.
 
+## Prerequisites
+
+The `podman`, `postgres`, `valkey`, and `nginx` roles must have been applied to the host first (they are shared services, intentionally not declared in `meta/main.yml` to keep immich deploys fast). Order them before `immich` in the playbook for fresh installs.
+
 ## Role Variables
 
 See `defaults/main.yml` for all available variables and their default values.