Merge branch 'feature/updater' into feature/store-i18n

Five conflicts, resolved by what each side is for rather than by taking a
side:

- sys-service/01_prune.yml and sys-service-terminator/02_unlock.yml take
  the incoming single `systemctl` invocation over four module loops. The
  unlock side also drops an unmask step: the list it runs on is built with
  `reject('search', ' masked')`, so it never held a masked unit and the
  step did nothing.
- sys-stk-front-proxy/tasks/main.yml keeps this branch's version. The block
  the other side still carries there moved into vhost.yml, which runs it
  once per network sibling; taking theirs would have duplicated it.
  vhost.yml holds every task of that block, the global injection and the
  TLS layer included.
- web-app-matomo/08_reinject_consumers.yml likewise keeps the per-vhost
  loop, which re-renders the injection for every network sibling and passes
  matomo_token_override.
- utils/cache/domains.py combines both: the incoming side rendered
  DOMAIN_PRIMARY with the real templar and variables, which is right, but
  added a second renderer beside the module's own. _render_plain now takes
  that context optionally, so the other two call sites stay as they were.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/utils/cache/test_domains.py

@@ -75,6 +75,40 @@ class TestMissingPrimaryDomain(unittest.TestCase):
             self.assertIsInstance(result, dict)
 
 
+class TestTemplatedPrimaryDomain(unittest.TestCase):
+    def setUp(self) -> None:
+        _reset_cache_for_tests()
+
+    def test_a_templated_domain_primary_resolves_against_the_play_variables(self):
+        captured: list[str] = []
+
+        def _capture(_self, _apps, primary_domain):
+            captured.append(primary_domain)
+            return {}
+
+        with tempfile.TemporaryDirectory() as tmp:
+            roles = _seed_minimal_role(Path(tmp))
+            with (
+                patch(
+                    "utils.cache.applications.get_merged_applications",
+                    return_value={},
+                ),
+                patch(
+                    "plugins.filter.canonical_domains_map.FilterModule.canonical_domains_map",
+                    _capture,
+                ),
+            ):
+                cache_domains.get_merged_domains(
+                    variables={
+                        "DOMAIN_PRIMARY": "{{ SOFTWARE_NAME | lower }}",
+                        "SOFTWARE_NAME": "Infinito.Nexus",
+                    },
+                    roles_dir=roles,
+                    templar=None,
+                )
+        self.assertEqual(captured, ["infinito.nexus"])
+
+
 class TestCachingPerVariablesSignature(unittest.TestCase):
     def setUp(self) -> None:
         _reset_cache_for_tests()