feat(frontend): rename inj roles to sys-front-*, add sys-svc-cdn, cache-busting lookup

Introduce sys-svc-cdn (cdn_paths/cdn_urls/cdn_dirs) and ensure CDN directories + latest symlink.

Rename sys-srv-web-inj-* → sys-front-inj-*; update includes/templates; serve shared/per-app CSS & JS via CDN.

Add lookup_plugins/local_mtime_qs.py for mtime-based cache busting; split CSS into default.css/bootstrap.css + optional per-app style.css.

CSP: use style-src-elem; drop unsafe-inline for styles. Services: fix SYS_SERVICE_ALL_ENABLED bool and controlled flush.

BREAKING CHANGE: role names changed; replace includes and references accordingly.

Conversation: https://chatgpt.com/share/68b55494-9ec4-800f-b559-44707029141d

tests/unit/lookup_plugins/test_local_mtime_qs.py

@@ -0,0 +1,50 @@
+import os
+import sys
+import tempfile
+import time
+import unittest
+
+# ensure repo root on path
+ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
+sys.path.insert(0, ROOT)
+
+from ansible.errors import AnsibleError  # type: ignore
+from lookup_plugins.local_mtime_qs import LookupModule
+
+
+class TestLocalMtimeQs(unittest.TestCase):
+    def setUp(self):
+        self.tmpdir = tempfile.TemporaryDirectory()
+        self.path = os.path.join(self.tmpdir.name, "file.css")
+        with open(self.path, "w", encoding="utf-8") as f:
+            f.write("body{}")
+        # set stable mtime
+        self.mtime = int(time.time()) - 123
+        os.utime(self.path, (self.mtime, self.mtime))
+
+    def tearDown(self):
+        self.tmpdir.cleanup()
+
+    def test_single_path_qs_default(self):
+        res = LookupModule().run([self.path])
+        self.assertEqual(res, [f"?version={self.mtime}"])
+
+    def test_single_path_epoch(self):
+        res = LookupModule().run([self.path], mode="epoch")
+        self.assertEqual(res, [str(self.mtime)])
+
+    def test_multiple_paths(self):
+        path2 = os.path.join(self.tmpdir.name, "a.js")
+        with open(path2, "w", encoding="utf-8") as f:
+            f.write("// js")
+        os.utime(path2, (self.mtime + 1, self.mtime + 1))
+        res = LookupModule().run([self.path, path2], param="v")
+        self.assertEqual(res, [f"?v={self.mtime}", f"?v={self.mtime + 1}"])
+
+    def test_missing_raises(self):
+        with self.assertRaises(AnsibleError):
+            LookupModule().run([os.path.join(self.tmpdir.name, "nope.css")])
+
+
+if __name__ == "__main__":
+    unittest.main()