fix(deploy): bootstrap the NFS client by its own group, not by swarm membership

3c07721303 put svc-swarm-node and svc-storage-nfs-client in one loop behind
"svc-swarm-node in group_names", so a host pulled the NFS client purely for
being a swarm node. storage.nfs.server defaults to the empty string, so on a
compose single host the client asserted itself out with "svc-storage-nfs-client
requires storage.nfs.server to be set in the inventory".

The swarm inventory places every svc-swarm-node host in svc-storage-nfs-client
as well, so requiring both leaves swarm deploys untouched and only drops the
run where the inventory never asked for a client. sys-svc-mail-msmtp and
sys-svc-compose already model it that way: both tolerate a host that is no NFS
client, and the mount is asserted only where the backend is nfs.

main carries this loop unchanged, so it is reachable there too: a role brings
the trigger in by declaring the node service consumer, and svc-registry-cache
and svc-registry-docker both do.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tasks/stages/02_server.yml

@@ -14,13 +14,17 @@
   loop_control:
     loop_var: server_role
 
-- name: "🥾 Bootstrap swarm cluster + NFS clients (must precede web-app render)"
-  ansible.builtin.include_role:
-    name: "{{ item }}"
-  loop:
-    - svc-swarm-node
-    - svc-storage-nfs-client
+- name: "🥾 Bootstrap the swarm node and NFS client before the web-app render"
   when: "'svc-swarm-node' in group_names"
+  block:
+    - name: "🥾 Bootstrap the swarm node"
+      ansible.builtin.include_role:
+        name: svc-swarm-node
+
+    - name: "🥾 Bootstrap the NFS client"
+      ansible.builtin.include_role:
+        name: svc-storage-nfs-client
+      when: "'svc-storage-nfs-client' in group_names"
 
 - name: "📂 Include server roles"
   include_tasks: ./tasks/utils/setup/group.yml