feat(sys-service): migrate cleanup/backup services to generic units; harden disk-space cleanup

Services: add SYS_SERVICE_CLEANUP_BACKUPS and SYS_SERVICE_CLEANUP_DISC_SPACE in group vars.

sys-ctl-bkp-docker-2-loc: switch to sys-service; add ExecStartPre lock; ExecStartPost triggers backup cleanup; OnFailure → cleanup-failed; fix shell quoting.

sys-ctl-cln-bkps: switch to sys-service; pass CLI args via ExecStart; add ExecStartPre lock; set OnFailure; copy files; remove role-specific service template.

sys-ctl-cln-disc-space: switch to sys-service; enable timer; set OnFailure; provide ExecStart/ExecStartPre; copy files; remove role-specific service template.

script.sh (disc-space): non-interactive docker exec; consistent threshold message (use parameter); guard docker/pacman via command checks; robust container check; fix typo; use POSIX '='.

svc-opt-keyboard-color: minor formatting cleanup.

sys-ctl-hlth-disc-space: chain OnFailure to cleanup-disc-space service.

Context: ChatGPT conversation (Sep 10, 2025, Europe/Berlin) — https://chatgpt.com/share/68c1982e-bdc8-800f-bf13-a8b9f084f90e

roles/sys-ctl-cln-disc-space/tasks/01_core.yml

@@ -8,5 +8,9 @@
 - include_role:
     name: sys-service
   vars:
-    system_service_timer_enabled:  true
-    system_service_on_calendar: "{{SYS_SCHEDULE_CLEANUP_DISC_SPACE}}"
+    system_service_timer_enabled:       true
+    system_service_copy_files:          true
+    system_service_on_calendar:         "{{ SYS_SCHEDULE_CLEANUP_DISC_SPACE }}"
+    system_service_tpl_on_failure:      "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
+    system_service_tpl_exec_start:      "{{ system_service_script_exec }} {{ SIZE_PERCENT_CLEANUP_DISC_SPACE }}"
+    system_service_tpl_exec_start_pre:  '/usr/bin/python {{ PATH_SYSTEM_LOCK_SCRIPT }} {{ SYS_SERVICE_GROUP_MANIPULATION | join(" ")  }} --ignore {{ SYS_SERVICE_GROUP_CLEANUP | join(" ") }} --timeout "{{ SYS_TIMEOUT_BACKUP_SERVICES }}"'