feat(frontend): rename inj roles to sys-front-*, add sys-svc-cdn, cache-busting lookup

Introduce sys-svc-cdn (cdn_paths/cdn_urls/cdn_dirs) and ensure CDN directories + latest symlink.

Rename sys-srv-web-inj-* → sys-front-inj-*; update includes/templates; serve shared/per-app CSS & JS via CDN.

Add lookup_plugins/local_mtime_qs.py for mtime-based cache busting; split CSS into default.css/bootstrap.css + optional per-app style.css.

CSP: use style-src-elem; drop unsafe-inline for styles. Services: fix SYS_SERVICE_ALL_ENABLED bool and controlled flush.

BREAKING CHANGE: role names changed; replace includes and references accordingly.

Conversation: https://chatgpt.com/share/68b55494-9ec4-800f-b559-44707029141d

roles/web-svc-cdn/config/main.yml

@@ -1,7 +1,7 @@
 features:
-  matomo:           true
-  css:              true
-  desktop:  false
+  matomo:  true
+  css:     true
+  desktop: false
 server:
   domains:
     canonical:

roles/web-svc-cdn/tasks/01_core.yml

@@ -11,8 +11,8 @@
   vars:
     http_port: "{{ ports.localhost.http[application_id] }}"
 
-- name: "generate '{{ CDN_NGINX_FILE }}'"
+- name: "deploy '{{ CDN_NGINX_PATH }}'"
   template:
     src: "nginx.conf.j2"
-    dest: "{{ NGINX.DIRECTORIES.HTTP.SERVERS }}{{ CDN_NGINX_FILE }}"
+    dest: "{{ CDN_NGINX_PATH }}"
   notify: restart openresty

roles/web-svc-cdn/templates/nginx.conf.j2

@@ -4,7 +4,7 @@ server
   
   {% include 'roles/srv-letsencrypt/templates/ssl_header.j2' %}
 
-  {% include 'roles/sys-srv-web-inj-compose/templates/server.conf.j2'%}
+  {% include 'roles/sys-front-inj-all/templates/server.conf.j2'%}
 
   {% include 'roles/srv-proxy-core/templates/headers/content_security_policy.conf.j2' %}
   
@@ -16,11 +16,11 @@ server
     autoindex on;                            {# Enable directory listing #}
     autoindex_exact_size off;                {# Display sizes in a human-readable format #}
     autoindex_localtime on;                  {# Show local time #}
-    {% include 'roles/sys-srv-web-inj-compose/templates/location.lua.j2' %}
+    {% include 'roles/sys-front-inj-all/templates/location.lua.j2' %}
   }
 
   location /.well-known/ {
-    alias {{NGINX.DIRECTORIES.DATA.WELL_KNOWN}};
+    alias {{ NGINX.DIRECTORIES.DATA.WELL_KNOWN }};
     allow all;
     default_type "text/plain";
     autoindex on;

roles/web-svc-cdn/vars/main.yml

@@ -4,3 +4,4 @@ domain:         "{{ domains | get_domain(application_id) }}"
 
 # CDN
 CDN_NGINX_FILE: "{{ domain }}.conf"
+CDN_NGINX_PATH: "{{ [ NGINX.DIRECTORIES.HTTP.SERVERS, CDN_NGINX_FILE ] | path_join }}"