refactor(compose): call the persisted-credential patch from one place

3831c8f804 gave matomo, moodle and nextcloud a patch each, called from their
own 00_core.yml. That file only runs while the role's run-once flag is unset,
so the patch runs on the deploy's first pass and never on the second -- which is
the only pass where a rotated credential exists. The app keeps the password it
was installed with while the engine moves on, and every request answers 500.

Run 33317483326 shows it on friendica, which had the same shape: svc-db-mariadb
altered the user at 15:39 and again at 16:26, either side of the 15:58 rotation,
while the app's config was patched once. The engine said what followed:

  [Warning] Access denied for user 'friendica'@'192.168.201.4' (using password: YES)

Five failed healthchecks in a row, swarm replaced the task, and the convergence
gate reported "tasks not running yet" for a service that started correctly every
time.

The call moves to post_deploy.yml, which runs after every deploy and sits behind
no role's flag. It includes roles/<app>/tasks/utils/patch_db_credentials.yml when
that file exists, so a role declares what to patch and nothing else: friendica
joins the other three with its volume, its config path and its expression.

It cannot live in the role. 00_core.yml has to set the run-once flag as its very
first task or load/app.yml re-includes the role and recurses, which
tests/lint/ansible/roles/test_service_core_first_task_run_once.py enforces, and
everything after that flag is closed to a second invocation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/sys-svc-compose/tasks/utils/post_deploy.yml

@@ -28,6 +28,12 @@
     - lookup('database', application_id, 'local') | bool
     - lookup('database', application_id, 'type') == 'postgres'
 
+- name: "🔑 Realign the password an app persisted in its own config"
+  ansible.builtin.include_tasks: "{{ _app_persisted_credentials }}"
+  vars:
+    _app_persisted_credentials: "{{ lookup('path_absolute', 'roles/' ~ application_id ~ '/tasks/utils/patch_db_credentials.yml') }}"
+  when: _app_persisted_credentials is exists
+
 - name: "⏳ Wait until swarm tasks of '{{ application_id | get_entity_name }}' are running"
   ansible.builtin.script: "{{ lookup('path_absolute', 'roles/sys-svc-compose/files/shell/swarm/stack_ready.sh') }}"
   environment:

roles/web-app-friendica/tasks/01_manager_ops.yml

@@ -41,10 +41,11 @@
 
 - name: 🩹 Patch Friendica local.config.php with updated DB credentials
   ansible.builtin.include_tasks:
-    file: 03_patch_config.yml
+    file: utils/patch_config.yml
     apply:
       notify: compose-up
   when: friendica_config_exists.rc == 0
+
 - name: ➕ Add Friendica Add Ons
   include_tasks: 04_addons.yml
 

roles/web-app-friendica/tasks/utils/patch_db_credentials.yml

@@ -0,0 +1,7 @@
+---
+- name: "🔑 Realign the password friendica persisted in its config"
+  include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-rdbms/tasks/utils/patch_persisted_password.yml') }}"
+  vars:
+    patch_volume: "friendica_html"
+    patch_config_rel: "config/local.config.php"
+    patch_expression: "s|('password'\\s*=>\\s*')[^']*(',)|\\1@PASSWORD@\\2|"

roles/web-app-matomo/tasks/00_core.yml

@@ -4,9 +4,6 @@
 - name: "🔍 Matomo | Resolve token from store/config"
   include_tasks: 01_token_store.yml
 
-- name: "🔑 Realign the persisted database credentials before the health gate"
-  include_tasks: utils/patch_db_credentials.yml
-
 - name: "🧩 load docker, db and proxy for {{ application_id }}"
   include_role:
     name: sys-stk-full

roles/web-app-moodle/tasks/00_core.yml

@@ -1,9 +1,6 @@
 ---
 - include_tasks: utils/once/flag.yml
 
-- name: "🔑 Realign the persisted database credentials before the health gate"
-  include_tasks: utils/patch_db_credentials.yml
-
 - name: "🚦 Declare the MCP edge limits before the vhost references them"
   include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-webserver-core/tasks/utils/mcp_edge_limits.yml') }}"
   when: MOODLE_MCP_ENABLED | bool

roles/web-app-nextcloud/tasks/00_core.yml

@@ -1,9 +1,6 @@
 ---
 - include_tasks: utils/once/flag.yml
 
-- name: "🔑 Realign the persisted database credentials before the health gate"
-  include_tasks: utils/patch_db_credentials.yml
-
 - name: "🚦 Declare the MCP edge limits before the vhost references them"
   include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-webserver-core/tasks/utils/mcp_edge_limits.yml') }}"
   when: NEXTCLOUD_MCP_ENABLED | bool