fix(sys-svc-rdbms): refuse a persisted-password patch that matches nothing

The script ran sed and printed PATCHED unconditionally, so an expression that
matched no line reported success and the deploy believed a rotated password had
reached the application's own config. Nothing downstream could tell the difference.

Adding the check found two expressions that could never have worked:

    friendica  sed: -e expression #1, char 44: invalid reference \2 on 's' command
    kix        sed: -e expression #1, char 59: Invalid content of \{\}

Both spell their groups as (...) with \1 \2, which is extended-regex syntax, while
the script called basic-regex sed. Under sed -E all five declarations match a sample
of the line they target -- friendica, matomo, moodle, nextcloud and kix -- so the fix
is the flag, not the expressions.

That makes 06f5905d64 incomplete: it moved friendica's patch in front of the health
gate, but the patch itself aborted sed on every run and said PATCHED anyway.

The dry pass uses the same expression the write will use, so a matching line is
proven before the file is touched rather than after.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/sys-svc-rdbms/files/shell/patch_persisted_password.sh

@@ -10,7 +10,8 @@
 #
 # Param: PATCH_VOLUME      - docker volume the app persists its config in
 # Param: PATCH_CONFIG_REL  - config path relative to that volume's mountpoint
-# Param: PATCH_EXPRESSION  - sed expression, with @PASSWORD@ where the value goes
+# Param: PATCH_EXPRESSION  - extended-regex sed expression (sed -E), with
+#                            @PASSWORD@ where the value goes
 # Param: PATCH_PASSWORD    - the value, already escaped for the sed delimiter
 set -euo pipefail
 
@@ -25,5 +26,12 @@ mountpoint="$(container volume inspect --format '{{.Mountpoint}}' "$PATCH_VOLUME
 config="${mountpoint}/${PATCH_CONFIG_REL}"
 test -f "$config" || exit 0
 
-sed -i "${PATCH_EXPRESSION//@PASSWORD@/$PATCH_PASSWORD}" "$config"
+expression="${PATCH_EXPRESSION//@PASSWORD@/$PATCH_PASSWORD}"
+
+if [ -z "$(sed -E -n "${expression}p" "$config" | head -n1)" ]; then
+  echo "FAILED: no line in ${PATCH_CONFIG_REL} matches the patch expression" >&2
+  exit 1
+fi
+
+sed -E -i "$expression" "$config"
 echo PATCHED