Refactor CDN and run_once handling

- Move run_once include from main.yml to 01_core.yml in desk-gnome-caffeine and desk-ssh
- Introduce sys-svc-cdn/01_core.yml to handle shared/vendor dirs once and role dirs per run
- Replace cdn.* with cdn_paths_all.* across inj roles
- Split cdn_dirs into cdn_dirs_role and CDN_DIRS_GLOBAL
- Ensure cdn_urls uses cdn_paths_all

Details: https://chatgpt.com/share/68b58d64-1e28-800f-8907-36926a9e9a9b

roles/sys-svc-cdn/vars/main.yml

@@ -1,19 +1,22 @@
 # Base CDN root (shared across all roles)
-CDN_ROOT:     "{{ NGINX.DIRECTORIES.DATA.CDN }}"
+CDN_ROOT:         "{{ NGINX.DIRECTORIES.DATA.CDN }}"
 
 # Default version identifier: UTC timestamp
-CDN_VERSION:  "latest" # Latest is used atm because timestamp based would just lead to an unneccessary overhead
+CDN_VERSION:      "latest" # Latest is used atm because timestamp based would just lead to an unneccessary overhead
 
 # Base Url to deliver the files
-CDN_BASE_URL: "{{ domains | get_url('web-svc-cdn', WEB_PROTOCOL) }}"
+CDN_BASE_URL:     "{{ domains | get_url('web-svc-cdn', WEB_PROTOCOL) }}"
 
 # Role specific CDN paths
 
 ## Build CDN path structure (via filter)
-cdn:          "{{ CDN_ROOT | cdn_paths(application_id, CDN_VERSION) }}"
+cdn_paths_all:    "{{ CDN_ROOT | cdn_paths(application_id, CDN_VERSION) }}"
+
+## Global CDN dirs
+CDN_DIRS_GLOBAL:  "{{ (cdn_paths_all.shared | cdn_dirs) + [cdn_paths_all.vendor] }}"
 
 ## Flatten CDN dict to list of all string paths
-cdn_dirs:     "{{ cdn | cdn_dirs }}"
+cdn_dirs_role:    "{{ cdn_paths_all.role | cdn_dirs }}"
 
 # Dictionary with all urls
-cdn_urls:     "{{ cdn | cdn_urls(CDN_BASE_URL) }}"
+cdn_urls:         "{{ cdn_paths_all | cdn_urls(CDN_BASE_URL) }}"