refactor: drop shared-service meta dependencies from service roles

podman, postgres, valkey, and nginx are shared services deployed once
per host. Declaring them in meta/main.yml re-ran them on every service
deploy, adding significant time to targeted runs. Playbooks now list
shared services first (tagged 'infra') and every role entry carries a
group tag plus its own name, so '--tags <role>' deploys just that role.

Roles still fail fast when a shared service is missing (password
asserts, postgresql tasks). Prerequisites are documented in role
READMEs. CLAUDE.md updated to reflect the new convention.

roles/immich/meta/main.yml

@@ -1,6 +1,7 @@
 ---
-dependencies:
-  - role: podman
-  - role: postgres
-  - role: valkey
-  - role: nginx
+# No meta dependencies: podman, postgres, valkey, and nginx are shared
+# services deployed once via the playbook (see playbooks/andromeda.yml
+# role ordering). Declaring them here would re-run them on every immich
+# deploy. The role fails fast if they are missing (password asserts,
+# postgresql_* tasks).
+dependencies: []