Refactor Akaunting role and CSP handling

- Improved CSP filter to properly include web-svc-cdn and use protocol-aware domains
- Added Todo.md with redis and OIDC notes
- Enhanced Akaunting role config with CSP flags and redis option
- Updated schema to include app_key validation
- Reworked tasks to handle first-run marker logic cleanly
- Fixed docker-compose template (marker, healthcheck, setup flag)
- Expanded env.j2 with cache, email, proxy, and redis options
- Added javascript.js.j2 template for SSO warning
- Introduced structured vars for Akaunting role
- Removed deprecated update-repository-with-files.yml task

See conversation: https://chatgpt.com/share/68af00df-2c74-800f-90b6-6ac5b29acdcb

roles/web-app-akaunting/tasks/main.yml

@@ -1,18 +1,24 @@
 ---
+- name: "Akaunting | Check if first run (marker exists?)"
+  ansible.builtin.stat:
+    path: "{{ AKAUNTING_SETUP_MARKER }}"
+  register: akaunting_marker_stat
+
+- name: "Akaunting | Decide if setup should be enabled"
+  ansible.builtin.set_fact:
+    akaunting_setup_enabled: "{{ not akaunting_marker_stat.stat.exists }}"
+
 - name: "For '{{ application_id }}': load docker, db and proxy"
-  include_role: 
+  include_role:
     name: cmp-db-docker-proxy
-
-- name: "include tasks update-repository-with-files.yml"
-  include_tasks: utils/update-repository-with-files.yml
   vars:
-    detached_files: 
-      - "docker-compose.yml"
+    # Forward flag into compose templating
+    cmp_extra_facts:
+      akaunting_setup_enabled: "{{ akaunting_setup_enabled }}"
 
-- name: "For '{{ application_id }}': create {{ docker_compose.files.env }}"
-  template: 
-    src:  "env.j2" 
-    dest: "{{ docker_compose.files.env }}"
-    mode: "0770"
-    force: yes
-  notify: docker compose up
+- name: "Akaunting | Create first-run marker to disable future setup"
+  ansible.builtin.file:
+    path: "{{ AKAUNTING_SETUP_MARKER }}"
+    state: touch
+    mode: "0644"
+  when: akaunting_setup_enabled | bool