fix(listmonk): reload the API user cache the way each deployment mode allows

After minting the MCP identity the role restarted Listmonk with `container restart`
on the container id. In swarm that id belongs to a task the orchestrator owns, and
the daemon refuses:

    Error response from daemon: Cannot restart container 21bda395f531: failed

Thirty attempts, the same refusal each time, and the job ended there.

The compose path keeps `container restart`; swarm gets `container service update
--force` on the service name, which is what the orchestrator offers for this and
what web-app-jellyfin already does to reload its plugins. The swarm branch needs no
delegate_to -- a service update is the manager's business, not that of whichever node
happens to hold the task -- and carries a timeout, because forcing an update waits
for convergence.

Both branches sit in one block under the shared `when: listmonk_mcp_identity.changed`
so the condition cannot drift apart, and run_once moves up with it. Only the mode
test stays per branch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-listmonk/tasks/utils/mcp.yml

@@ -29,15 +29,24 @@
     resolve_compose_cid: "{{ LISTMONK_NAME }}"
 
 - name: "🔄 Restart Listmonk so it reloads its API user cache"
-  ansible.builtin.command:
-    argv:
-      - container
-      - restart
-      - "{{ LISTMONK_IDENTITY_LOCAL_CID }}" # nocheck: container-exec-resolver
-  changed_when: true
   when: listmonk_mcp_identity.changed
-  delegate_to: "{{ LISTMONK_IDENTITY_HOST_NODE }}"
   run_once: true
+  block:
+    - name: "🔄 compose | restart the Listmonk container"
+      ansible.builtin.command:
+        argv:
+          - container
+          - restart
+          - "{{ LISTMONK_IDENTITY_LOCAL_CID }}" # nocheck: container-exec-resolver
+      changed_when: true
+      when: DEPLOYMENT_MODE == 'compose'
+      delegate_to: "{{ LISTMONK_IDENTITY_HOST_NODE }}"
+
+    - name: "🔄 swarm | force an update of the Listmonk service"
+      ansible.builtin.command: "container service update --force {{ lookup('container_service', application_id, 'listmonk') }}"
+      changed_when: true
+      timeout: "{{ lookup('timeout', 600) | int }}"
+      when: DEPLOYMENT_MODE == 'swarm'
 
 - name: "🩺 Prove the MCP contract of {{ application_id }}"
   ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/svc-ai-mcp-adapter/tasks/probe.yml') }}"