fix(web-svc-libretranslate): route the build host pin through the extra_hosts lookup

942ca18b85 wrote `extra_hosts:` into the build block by hand and tripped three
repository lints.

The first is not cosmetic. container_extra_hosts calls itself the single
emitter of that key because it also sets it for the SSO back-channel, so a
second literal block puts the key into the same mapping twice and one of the
two lists is dropped without a word. The argos pin now goes through the
lookup, with the entry list assembled in vars and empty when no cache frontend
is configured.

That removes the `{% if %}` wrapper as well, and with it the second finding:
the lookup returns an empty string when it has nothing to emit, so the
template needs no conditional and no misindented Jinja tags.

The third replaces a hand-built `[playbook_dir, ...] | path_join` with
lookup('path_absolute', ...), which owns the repo-root anchor.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-svc-libretranslate/tasks/00_core.yml

@@ -30,7 +30,7 @@
 
 - name: "🔐 Stage the package-cache CA installer of {{ application_id }}"
   stack_host_copy:
-    src: "{{ [playbook_dir, LIBRETRANSLATE_CACHE_CA_INSTALLER] | path_join }}"
+    src: "{{ lookup('path_absolute', LIBRETRANSLATE_CACHE_CA_INSTALLER) }}"
     dest: "{{ [lookup('container', application_id, 'directories.instance'), 'package-frontend-ca.sh'] | path_join }}"
     mode: "0755"
   notify:

roles/web-svc-libretranslate/templates/compose.yml.j2

@@ -5,10 +5,7 @@
     {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
       cache_from:
         - "{{ lookup('image', application_id, 'libretranslate') }}"
-{% if LIBRETRANSLATE_CACHE_FRONTEND_IP | length > 0 %}
-      extra_hosts:
-        - "argos-net.com:{{ LIBRETRANSLATE_CACHE_FRONTEND_IP }}"
-{% endif %}
+      {{ lookup('container_extra_hosts', extra_hosts=LIBRETRANSLATE_BUILD_HOSTS) | indent(6) }}
       args:
         BUILDKIT_INLINE_CACHE: "1"
         LIBRETRANSLATE_IMAGE: "{{ LIBRETRANSLATE_IMAGE }}"

roles/web-svc-libretranslate/vars/main.yml

@@ -33,3 +33,4 @@ LIBRETRANSLATE_MCP_UPSTREAM_KEY: ""
 LIBRETRANSLATE_CACHE_CA_FILE: /opt/package-frontend-ca.crt
 LIBRETRANSLATE_CACHE_CA_INSTALLER: scripts/docker/cache/package-frontend/ca.sh
 LIBRETRANSLATE_CACHE_FRONTEND_IP: "{{ lookup('env', 'INFINITO_CACHE_PACKAGE_FRONTEND_IP') }}"
+LIBRETRANSLATE_BUILD_HOSTS: "{{ ['argos-net.com:' ~ LIBRETRANSLATE_CACHE_FRONTEND_IP] if LIBRETRANSLATE_CACHE_FRONTEND_IP | length > 0 else [] }}"