refactor!: replace sys-systemctl with sys-service, add sys-daemon, and rename systemctl_* → system_service_* across repo

- Swap role includes: sys-systemctl → sys-service in all roles
- Rename variables everywhere: systemctl_* → system_service_* (incl. systemctl_id → system_service_id)
- Templates: ExecStart now uses {{ system_service_script_exec }}; add optional RuntimeMaxSec via SYS_SERVICE_DEFAULT_RUNTIME
- Move SYS_SERVICE defaults into roles/sys-service/defaults (remove SYS_SERVICE_ALL_ENABLED & SYS_SERVICE_DEFAULT_STATE from group_vars/07_services.yml)
- Tidy group_vars/all/08_timer.yml formatting
- Introduce roles/sys-daemon:
  - default manager timeouts (timeouts.conf)
  - optional purge of /etc/systemd/system.conf.d
  - validation via systemd-analyze verify
  - handlers for daemon-reload & daemon-reexec
- Refactor sys-timer to system_service_* variables (docs and templates updated)
- Move filter_plugins/filetype.py under sys-service
- Update meta/README to point to official systemd docs
- Touch many roles (backup/cleanup/health/repair/certs/nginx/csp/wireguard/ssd-hdd/keyboard/update-docker/alarm compose/email/telegram/etc.) to new naming

BREAKING CHANGE:
- Role path/name change: use `sys-service` instead of `sys-systemctl`
- All `systemctl_*` vars are now `system_service_*` (e.g., on_calendar, state, timer_enabled, script_exec, id)
- If you have custom templates, adopt RuntimeMaxSec and new variable names

Chat context: https://chatgpt.com/share/68a47568-312c-800f-af3f-e98575446327

roles/sys-service/tasks/01_core.yml

@@ -0,0 +1,8 @@
+- name: Include dependency 'sys-daemon'
+  include_role:
+    name: sys-daemon
+  when: run_once_sys_daemon is not defined
+  
+- name: "reset (if enabled)"
+  include_tasks: 02_reset.yml
+  when: MODE_RESET | bool

roles/sys-service/tasks/02_reset.yml

@@ -0,0 +1,10 @@
+- name: "pkgmgr install '{{ UNIT_SUFFIX_REMOVER_PACKAGE }}'"
+  include_role:
+    name: pkgmgr-install
+  vars:
+    package_name: "{{ UNIT_SUFFIX_REMOVER_PACKAGE }}"
+
+- name: Remove all '{{ SYS_SERVICE_SUFFIX }}' files with '{{ UNIT_SUFFIX_REMOVER_PACKAGE }}'
+  command: "{{ UNIT_SUFFIX_REMOVER_PACKAGE }} -s '{{ SOFTWARE_NAME }}'"
+  notify: "reload system daemon"
+  

roles/sys-service/tasks/03_base.yml

@@ -0,0 +1,29 @@
+- name: "find best matching source for service script"
+  set_fact:
+    system_service_script_src: >-
+      {{ lookup('first_found',
+        {
+          'files': [
+            'templates/script.sh.j2',
+            'templates/script.py.j2',
+            'files/script.sh',
+            'files/script.py'
+          ],
+          'paths': [ system_service_role_dir ]
+        },
+        errors='strict'
+      ) }}
+  when: system_service_copy_files | bool
+
+- name: "Load file logic for '{{ system_service_id }}'"
+  include_tasks: 04_files.yml
+  when:
+    - system_service_copy_files | bool
+    - system_service_script_src
+
+- name: "Load systemctl logic for '{{ system_service_id }}'"
+  include_tasks: 05_service.yml
+
+- name: "Load timer logic for '{{ system_service_id }}'"
+  include_tasks: 06_timer.yml
+  when: system_service_timer_enabled | bool

roles/sys-service/tasks/04_files.yml

@@ -0,0 +1,23 @@
+
+- name: "create {{ system_service_script_dir }}"
+  file:
+    path: "{{ system_service_script_dir }}"
+    state: directory
+    mode: "0755"
+
+- name: "template or copy script"
+  block:
+    - name: "render template"
+      template:
+        src:  "{{ system_service_script_src }}"
+        dest: "{{ [system_service_script_dir, (system_service_script_src | basename | regex_replace('\\.j2$', ''))] | path_join }}"
+        mode: "0755"
+      when: system_service_script_src.endswith('.j2')
+
+    - name: "copy raw file"
+      copy:
+        src:  "{{ system_service_script_src }}"
+        dest: "{{ [system_service_script_dir, (system_service_script_src | basename)] | path_join }}"
+        mode: "0755"
+      when: not system_service_script_src.endswith('.j2')
+  when: system_service_copy_files | bool

roles/sys-service/tasks/05_service.yml

@@ -0,0 +1,47 @@
+# 1) Find the template (prefer target role, then fall back to this role)
+- name: Resolve systemctl template source
+  set_fact:
+    system_service_template_src: >-
+      {{ lookup(
+           'first_found',
+           {
+             'files': [
+               'templates/systemctl@.service.j2',
+               'templates/systemctl.service.j2'
+             ],
+             'paths': [
+               system_service_role_dir,
+               role_path
+             ]
+           },
+           errors='strict'
+         ) }}
+
+# Optional: sanity check with a clear error if truly nothing found
+- name: Ensure a systemctl template was found
+  assert:
+    that: system_service_template_src | length > 0
+    fail_msg: >-
+      Could not resolve any systemctl template. Looked in:
+      {{ system_service_role_dir }}/templates/ and {{ role_path }}/templates/.
+
+# 2) Now we may safely derive whether it’s the “@” variant
+- name: Flag whether @-template is used
+  set_fact:
+    system_service_uses_at: "{{ (system_service_template_src | basename) is search('@\\.service\\.j2$') }}"
+
+# 3) Use it
+- name: "setup systemctl '{{ system_service_id }}'"
+  template:
+    src:  "{{ system_service_template_src }}"
+    dest: "{{ [ PATH_SYSTEM_SERVICE_DIR, system_service_id | get_service_name(SOFTWARE_NAME) ] | path_join }}"
+  notify: "{{ 'reload system daemon' if system_service_uses_at else 'refresh systemctl service' }}"
+
+- name:   refresh systemctl service when SYS_SERVICE_ALL_ENABLED
+  command: /bin/true
+  notify:
+    - reload system daemon
+    - refresh systemctl service
+  when: 
+    - SYS_SERVICE_ALL_ENABLED | bool
+    - not system_service_uses_at

roles/sys-service/tasks/06_timer.yml

@@ -0,0 +1,13 @@
+- name: Fail if system_service_id contains "@"
+  assert:
+    that:
+      - "'@' not in system_service_id"
+    fail_msg: "Invalid system_service_id '{{ system_service_id }}' → must not contain '@'."
+
+- name: "Make '{{ system_service_id }}' available for sys-timer"
+  set_fact:
+    system_service_timer_service: "{{ system_service_id }}"
+
+- name: "include role for sys-timer for {{ system_service_timer_service }}"
+  include_role:
+    name: sys-timer

roles/sys-service/tasks/main.yml

@@ -0,0 +1,14 @@
+- block:
+  - include_tasks: 01_core.yml
+  - include_tasks: utils/run_once.yml
+  when: run_once_sys_service is not defined
+
+- name: "Execute service routines for '{{ system_service_id }}'"
+  block:
+  - name: "Load base routine for '{{ system_service_id }}'"
+    include_tasks: 03_base.yml
+  - include_tasks: utils/run_once.yml
+    vars:
+      # Necessary to flush after every service which uses an 'system_service_id' otherwise wrong one will be used
+      flush_handlers: true
+  when: system_service_id is defined