fix(sys-svc-rdbms): patch the persisted password before the health gate again

1f870b1e5 gave the patch one call site and put it in post_deploy.yml, which runs
after the deploy has waited for the stack. 3831c8f804 had named the constraint in
its own subject line: before the health gate. An app whose health check
authenticates against its own database fails that check with the password it
persisted, compose gives up with "dependency failed to start: container matomo is
unhealthy", and nothing behind the gate ever runs -- including the patch that
would have fixed it.

Measured, not argued: with the call in post_deploy.yml a local compose deploy of
five roles passed its first pass at ok=4571 failed=0 and died in the second, the
one that carries the rotated credential. With the call back in front, all three
passes report failed=0 and the Playwright specs pass in both.

sys-svc-rdbms/tasks/main.yml is where it goes: the stack include reaches it
before anything comes up, it is per-consumer rather than per-role-once, and it
still resolves the declaration through the same path, so there is still exactly
one call site. The patch reads the volume from the host and needs no running
container, which is what makes the earlier position possible at all; before the
first deploy has created the volume it exits without doing anything.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/sys-svc-compose/tasks/utils/post_deploy.yml

@@ -28,12 +28,6 @@
     - lookup('database', application_id, 'local') | bool
     - lookup('database', application_id, 'type') == 'postgres'
 
-- name: "🔑 Realign the password an app persisted in its own config"
-  ansible.builtin.include_tasks: "{{ _app_persisted_credentials }}"
-  vars:
-    _app_persisted_credentials: "{{ lookup('path_absolute', 'roles/' ~ application_id ~ '/tasks/utils/patch/db_credentials.yml') }}"
-  when: _app_persisted_credentials is exists
-
 - name: "⏳ Wait until swarm tasks of '{{ application_id | get_entity_name }}' are running"
   ansible.builtin.script: "{{ lookup('path_absolute', 'roles/sys-svc-compose/files/shell/swarm/stack_ready.sh') }}"
   environment:

roles/sys-svc-rdbms/tasks/main.yml

@@ -26,6 +26,12 @@
     - _sys_svc_rdbms_consumer_local | bool
     - _sys_svc_rdbms_compose_template.stat.exists
 
+- name: "🔑 Realign '{{ application_id }}' persisted password before the health gate"
+  ansible.builtin.include_tasks: "{{ _app_persisted_credentials }}"
+  vars:
+    _app_persisted_credentials: "{{ lookup('path_absolute', 'roles/' ~ application_id ~ '/tasks/utils/patch/db_credentials.yml') }}"
+  when: _app_persisted_credentials is exists
+
 - name: 🗄️ Central Database Logic
   block:
     - name: "✅ For '{{ application_id }}': Assert shared database provider was preloaded"