refactor: cluster-wide shared-DB detection + openresty-host gating + load_app guard

sys-svc-rdbms now decides central-DB vs dedicated-DB mode from the provider
group's presence in the inventory (groups[provider_id] | length > 0)
instead of the per-host lookup('database', _, 'shared'). The old form
returned different values on different hosts (e.g. mariadb.shared =
'svc-db-mariadb' in group_names), so workers would silently disagree with
the manager about which mode is active and trip the central-init handlers
on the wrong host. The central-init block now also gates on the host
actually being in the provider group.

sys-stk-full guards the sys-stk-front-proxy include behind
"inventory_hostname in groups['svc-prx-openresty']", so under swarm only
the openresty host renders the per-app vhost. Combined with the
compose-mode auto-place from the previous commit, single-host compose and
swarm both pick exactly one host.

tasks/utils/load_app.yml skips loading a role for hosts that are not in
its target group when a group exists, matching the new gating semantic
upstream.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

roles/sys-stk-full/tasks/main.yml

@@ -15,13 +15,14 @@
       }}
   changed_when: false
 
-- name: "For '{{ application_id }}': include role sys-stk-front-proxy"
+- name: "For '{{ application_id }}': include role sys-stk-front-proxy (only on openresty host)"
   include_role:
     name: sys-stk-front-proxy
   vars:
     application_id: "{{ sys_stk_full_application_id }}"
     domain: "{{ sys_stk_full_domain }}"
     http_port: "{{ sys_stk_full_http_port }}"
+  when: inventory_hostname in (groups['svc-prx-openresty'] | default([]))
 
 - name: "For '{{ application_id }}': load docker and db"
   include_role:

roles/sys-svc-rdbms/tasks/main.yml

@@ -8,7 +8,7 @@
 - name: "For '{{ application_id }}/{{ _database_consumer_id }}': Resolve shared database mode"
   set_fact:
     _sys_svc_rdbms_central_db_enabled: >-
-      {{ lookup('database', _database_consumer_id, 'shared') | bool }}
+      {{ (groups[lookup('database', _database_consumer_id, 'id')] | default([])) | length > 0 }}
   changed_when: false
 
 - name: "For '{{ application_id }}/{{ _database_consumer_id }}': Apply dedicated database setup"
@@ -52,4 +52,6 @@
     database_name: "{{ lookup('database', _database_consumer_id, 'name') }}"
     database_username: "{{ lookup('database', _database_consumer_id, 'username') }}"
     database_password: "{{ lookup('database', _database_consumer_id, 'password') }}"
-  when: _sys_svc_rdbms_central_db_enabled | bool
+  when:
+    - _sys_svc_rdbms_central_db_enabled | bool
+    - inventory_hostname in (groups[lookup('database', _database_consumer_id, 'id')] | default([]))

tasks/utils/load_app.yml

@@ -13,3 +13,5 @@
   vars:
     application_id: "{{ load_app_id }}"
     domain: "{{ lookup('domain', load_app_id) }}"
+  when:
+    - groups[load_app_id] is not defined or inventory_hostname in groups[load_app_id]