fix(web-app-bigbluebutton): gate the post-stk-full body behind IS_STACK_HOST

Set BBB Facts referenced compose_repository_path which sys-stk-full only
materialises on the host that owns the stack. Under swarm-mode
delegation the role plays on every host so workers hit
"compose_repository_path is undefined" before any container exec ran.
Affected job in CI run 27006276488: web-app-bigbluebutton.

The same applies to every task that follows on the BBB side (compose
override render, env-file symlink, compose.yml include, the
flush/postgres/admin trio) - all touch host fs paths or run container
exec against the BBB stack. Move them into a new 01a_manager_ops.yml
and have 01_core include it only when IS_STACK_HOST is true. The
sys-stk-full include, the optional seed include and the
websocket_upgrade.conf gate stay where they are; the run-once flag
stays ungated at the end so workers still flip the marker.

roles/web-app-bigbluebutton/tasks/01_core.yml

@@ -38,35 +38,8 @@
   when: IS_STACK_HOST | bool
   notify: restart openresty
 
-- name: "Set BBB Facts"
-  set_fact:
-    BBB_ENV_FILE_LINK: "{{ [ compose_repository_path, '.env' ] | path_join }}"
-    BBB_ENV_FILE_ORIGINE: "{{ lookup('container', application_id, 'files.env') }}"
-    BBB_COMPOSE_FILE_ORIGINE: "{{ [ compose_repository_path, 'docker-compose.yml' ] | path_join }}"
-    BBB_COMPOSE_FILE_FINAL: "{{ [ lookup('container', application_id, 'directories.instance'), 'compose.yml' ] | path_join }}"
-
-- name: Write compose.override.yml for BigBlueButton
-  template:
-    src: compose.override.yml.j2
-    dest: "{{ [ lookup('container', application_id, 'directories.instance'), 'compose.override.yml' ] | path_join }}"
-  notify: compose up
-
-- name: Create symbolic link from .env file to target location
-  file:
-    src: "{{ BBB_ENV_FILE_ORIGINE }}"
-    dest: "{{ BBB_ENV_FILE_LINK }}"
-    state: link
-
-- name: "Setup compose.yml file"
-  include_tasks: "02_compose.yml"
-
-- name: flush docker service
-  meta: flush_handlers
-
-- name: "Ensure PostgreSQL password matches POSTGRESQL_SECRET"
-  include_tasks: "02a_postgres_password_sync.yml"
-
-- name: "Setup administrator"
-  include_tasks: "03_administrator.yml"
+- name: "BBB manager-side operations (compose render + container exec)"
+  include_tasks: 01a_manager_ops.yml
+  when: IS_STACK_HOST | bool
 
 - include_tasks: utils/once/flag.yml

roles/web-app-bigbluebutton/tasks/01a_manager_ops.yml

@@ -0,0 +1,31 @@
+---
+- name: "Set BBB Facts"
+  set_fact:
+    BBB_ENV_FILE_LINK: "{{ [compose_repository_path, '.env'] | path_join }}"
+    BBB_ENV_FILE_ORIGINE: "{{ lookup('container', application_id, 'files.env') }}"
+    BBB_COMPOSE_FILE_ORIGINE: "{{ [compose_repository_path, 'docker-compose.yml'] | path_join }}"
+    BBB_COMPOSE_FILE_FINAL: "{{ [lookup('container', application_id, 'directories.instance'), 'compose.yml'] | path_join }}"
+
+- name: Write compose.override.yml for BigBlueButton
+  template:
+    src: compose.override.yml.j2
+    dest: "{{ [lookup('container', application_id, 'directories.instance'), 'compose.override.yml'] | path_join }}"
+  notify: compose up
+
+- name: Create symbolic link from .env file to target location
+  file:
+    src: "{{ BBB_ENV_FILE_ORIGINE }}"
+    dest: "{{ BBB_ENV_FILE_LINK }}"
+    state: link
+
+- name: "Setup compose.yml file"
+  include_tasks: "02_compose.yml"
+
+- name: flush docker service
+  meta: flush_handlers
+
+- name: "Ensure PostgreSQL password matches POSTGRESQL_SECRET"
+  include_tasks: "02a_postgres_password_sync.yml"
+
+- name: "Setup administrator"
+  include_tasks: "03_administrator.yml"