refactor!: replace sys-systemctl with sys-service, add sys-daemon, and rename systemctl_* → system_service_* across repo

- Swap role includes: sys-systemctl → sys-service in all roles
- Rename variables everywhere: systemctl_* → system_service_* (incl. systemctl_id → system_service_id)
- Templates: ExecStart now uses {{ system_service_script_exec }}; add optional RuntimeMaxSec via SYS_SERVICE_DEFAULT_RUNTIME
- Move SYS_SERVICE defaults into roles/sys-service/defaults (remove SYS_SERVICE_ALL_ENABLED & SYS_SERVICE_DEFAULT_STATE from group_vars/07_services.yml)
- Tidy group_vars/all/08_timer.yml formatting
- Introduce roles/sys-daemon:
  - default manager timeouts (timeouts.conf)
  - optional purge of /etc/systemd/system.conf.d
  - validation via systemd-analyze verify
  - handlers for daemon-reload & daemon-reexec
- Refactor sys-timer to system_service_* variables (docs and templates updated)
- Move filter_plugins/filetype.py under sys-service
- Update meta/README to point to official systemd docs
- Touch many roles (backup/cleanup/health/repair/certs/nginx/csp/wireguard/ssd-hdd/keyboard/update-docker/alarm compose/email/telegram/etc.) to new naming

BREAKING CHANGE:
- Role path/name change: use `sys-service` instead of `sys-systemctl`
- All `systemctl_*` vars are now `system_service_*` (e.g., on_calendar, state, timer_enabled, script_exec, id)
- If you have custom templates, adopt RuntimeMaxSec and new variable names

Chat context: https://chatgpt.com/share/68a47568-312c-800f-af3f-e98575446327

roles/sys-service/tasks/05_service.yml

@@ -0,0 +1,47 @@
+# 1) Find the template (prefer target role, then fall back to this role)
+- name: Resolve systemctl template source
+  set_fact:
+    system_service_template_src: >-
+      {{ lookup(
+           'first_found',
+           {
+             'files': [
+               'templates/systemctl@.service.j2',
+               'templates/systemctl.service.j2'
+             ],
+             'paths': [
+               system_service_role_dir,
+               role_path
+             ]
+           },
+           errors='strict'
+         ) }}
+
+# Optional: sanity check with a clear error if truly nothing found
+- name: Ensure a systemctl template was found
+  assert:
+    that: system_service_template_src | length > 0
+    fail_msg: >-
+      Could not resolve any systemctl template. Looked in:
+      {{ system_service_role_dir }}/templates/ and {{ role_path }}/templates/.
+
+# 2) Now we may safely derive whether it’s the “@” variant
+- name: Flag whether @-template is used
+  set_fact:
+    system_service_uses_at: "{{ (system_service_template_src | basename) is search('@\\.service\\.j2$') }}"
+
+# 3) Use it
+- name: "setup systemctl '{{ system_service_id }}'"
+  template:
+    src:  "{{ system_service_template_src }}"
+    dest: "{{ [ PATH_SYSTEM_SERVICE_DIR, system_service_id | get_service_name(SOFTWARE_NAME) ] | path_join }}"
+  notify: "{{ 'reload system daemon' if system_service_uses_at else 'refresh systemctl service' }}"
+
+- name:   refresh systemctl service when SYS_SERVICE_ALL_ENABLED
+  command: /bin/true
+  notify:
+    - reload system daemon
+    - refresh systemctl service
+  when: 
+    - SYS_SERVICE_ALL_ENABLED | bool
+    - not system_service_uses_at