Refactor CDN and run_once handling

- Move run_once include from main.yml to 01_core.yml in desk-gnome-caffeine and desk-ssh
- Introduce sys-svc-cdn/01_core.yml to handle shared/vendor dirs once and role dirs per run
- Replace cdn.* with cdn_paths_all.* across inj roles
- Split cdn_dirs into cdn_dirs_role and CDN_DIRS_GLOBAL
- Ensure cdn_urls uses cdn_paths_all

Details: https://chatgpt.com/share/68b58d64-1e28-800f-8907-36926a9e9a9b

roles/sys-front-inj-css/tasks/01_core.yml

@@ -14,7 +14,7 @@
 - name: Deploy default CSS files
   template:
     src:    "{{ ['css', item ~ '.j2'] | path_join }}"
-    dest:   "{{ [cdn.shared.css, item] | path_join }}"
+    dest:   "{{ [cdn_paths_all.shared.css, item] | path_join }}"
     owner:  "{{ NGINX.USER }}"
     group:  "{{ NGINX.USER }}"
     mode:   '0644'