fix(roles): set the run-once flag as the first 01_core task for shared providers

test_service_core_first_task_run_once requires tasks/01_core.yml to set the
run_once flag (include_tasks: utils/once/flag.yml) as its very first task so the
guard is in place before the role body runs and the variant-aware loader cannot
recurse. Move the flag include from the end to the top in the shared-provider
roles that had it last (bigbluebutton, flowise, gitlab, matrix, mattermost,
moodle, openproject, openwebui, peertube, suitecrm, xwiki).

Also give the template-only providers svc-db-redis and svc-db-memcached the
run-once guard (main.yml includes 01_core.yml when run_once_<role> is undefined;
01_core.yml sets the flag) so they satisfy the shared-provider run_once guard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/svc-db-memcached/tasks/01_core.yml

@@ -0,0 +1,2 @@
+---
+- include_tasks: utils/once/flag.yml

roles/svc-db-memcached/tasks/main.yml

@@ -1,3 +1,5 @@
 ---
-# Template-only role: ships the Memcached Docker Compose snippet under templates/
-# for consumer roles to render into their own compose stack. No runtime tasks.
+- include_tasks: 01_core.yml
+  when: run_once_svc_db_memcached is not defined
+  vars:
+    application_id: svc-db-memcached

roles/svc-db-redis/tasks/01_core.yml

@@ -0,0 +1,2 @@
+---
+- include_tasks: utils/once/flag.yml

roles/svc-db-redis/tasks/main.yml

@@ -1,3 +1,5 @@
 ---
-# Template-only role: ships the Redis Docker Compose snippet under templates/
-# for consumer roles to render into their own compose stack. No runtime tasks.
+- include_tasks: 01_core.yml
+  when: run_once_svc_db_redis is not defined
+  vars:
+    application_id: svc-db-redis

roles/web-app-bigbluebutton/tasks/01_core.yml

@@ -1,4 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "load docker, proxy for '{{ application_id }}'"
   include_role:
     name: sys-stk-full
@@ -67,5 +69,3 @@
 
 - name: "Setup administrator"
   include_tasks: "03_administrator.yml"
-
-- include_tasks: utils/once/flag.yml

roles/web-app-flowise/tasks/01_core.yml

@@ -1,4 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "load docker and db for {{ application_id }}"
   include_role:
     name: sys-stk-backend
@@ -20,5 +22,3 @@
   vars:
     domain: "{{ lookup('domain',application_id) }}"
     http_port: "{{ lookup('config', application_id, 'services.flowise.ports.local.http') }}"
-
-- include_tasks: utils/once/flag.yml

roles/web-app-gitlab/tasks/01_core.yml

@@ -1,6 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "load docker, db and proxy for {{ application_id }}"
   include_role:
     name: sys-stk-full
-
-- include_tasks: utils/once/flag.yml

roles/web-app-matrix/tasks/01_core.yml

@@ -1,4 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "set matrix flavor"
   ansible.builtin.set_fact:
     matrix_flavor: "{{ lookup('config', application_id, 'services.matrix.flavor', 'ansible') }}"
@@ -17,5 +19,3 @@
 - name: "dispatch to compose flavor (deprecated; in-repo compose stack)"
   include_tasks: flavor/compose/main.yml
   when: matrix_flavor == 'compose'
-
-- include_tasks: utils/once/flag.yml

roles/web-app-mattermost/tasks/01_core.yml

@@ -1,4 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "Remove stale nginx config for renamed domain chat.{{ DOMAIN_PRIMARY }}" # nocheck: domain-spot
   ansible.builtin.file:
     path: "{{ [lookup('nginx', 'directories.configuration.servers'), 'https', 'chat.' ~ DOMAIN_PRIMARY ~ '.conf'] | path_join }}"
@@ -17,5 +19,3 @@
 - name: "Configure Keycloak OIDC mappers for Mattermost"
   include_tasks: 02_keycloak.yml
   when: MATTERMOST_OIDC_ENABLED | bool
-
-- include_tasks: utils/once/flag.yml

roles/web-app-moodle/tasks/01_core.yml

@@ -1,4 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "load docker, db and proxy for {{ application_id }}"
   include_role:
     name: sys-stk-full
@@ -89,5 +91,3 @@
 - name: "Configure auth_ldap (sync-only in variant 0, primary login in variant 1)"
   include_tasks: 04_ldap_sync.yml
   when: MOODLE_LDAP_ENABLED | bool
-
-- include_tasks: utils/once/flag.yml

roles/web-app-openproject/tasks/01_core.yml

@@ -1,4 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "load docker, db and proxy for {{ application_id }}"
   include_role:
     name: sys-stk-full
@@ -42,5 +44,3 @@
 
 - name: Create OpenProject Administrator
   include_tasks: 03_admin.yml
-
-- include_tasks: utils/once/flag.yml

roles/web-app-openwebui/tasks/01_core.yml

@@ -1,8 +1,8 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "load docker, proxy for '{{ application_id }}'"
   include_role:
     name: sys-stk-full
   vars:
     compose_repository_pull: false
-
-- include_tasks: utils/once/flag.yml

roles/web-app-peertube/tasks/01_core.yml

@@ -1,11 +1,12 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "include _create-domains.yml for peertube"
   include_tasks: _create-domains.yml
   loop: "{{ lookup('domains', application_id) }}"
   loop_control:
     loop_var: domain
   vars:
-    # Websockt and http listen to the same port
     http_port: "{{ lookup('config', application_id, 'services.peertube.ports.local.http') }}"
     websocket_port: "{{ lookup('config', application_id, 'services.peertube.ports.local.http') }}"
 
@@ -25,5 +26,3 @@
 - name: "Deinstall and disable auth-openid-connect plugin if OIDC is enabled"
   include_tasks: oidc/disable.yml
   when: not PEERTUBE_OIDC_ENABLED | bool
-
-- include_tasks: utils/once/flag.yml

roles/web-app-suitecrm/tasks/01_core.yml

@@ -1,4 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: "Load docker, db and proxy for {{ application_id }}"
   include_role:
     name: sys-stk-full
@@ -30,5 +32,3 @@
 
 - name: "Docker Compose Up for '{{ application_id }}'"
   meta: flush_handlers
-
-- include_tasks: utils/once/flag.yml

roles/web-app-xwiki/tasks/01_core.yml

@@ -1,4 +1,6 @@
 ---
+- include_tasks: utils/once/flag.yml
+
 - name: Validate XWiki variables
   include_tasks: 02_validation.yml
 
@@ -83,5 +85,3 @@
   vars:
     xwiki_oidc_enabled_switch: "{{ XWIKI_OIDC_ENABLED | bool }}"
     xwiki_ldap_enabled_switch: "{{ XWIKI_LDAP_ENABLED | bool }}"
-
-- include_tasks: utils/once/flag.yml