refactor(mail): let msmtp use the trust store instead of naming one

msmtp has defaulted tls_trust_file to the special value 'system' since 1.8.2,
and 'system' is exactly what the platform already curates: with-ca-trust.sh
installs the root anchor through update-ca-certificates, update-ca-trust or
trust, whichever the distribution has, and never needs a path. The deleted
apparatus reimplemented that by hand and measured the wrong machine - it
stat'ed candidate paths on the Ansible target while the rendered file is read
inside Debian containers, so a RedHat host would have named a path those images
do not have.

Measured on a live Debian node with no config file at all, i.e. the state this
commit produces: msmtp reports tls_trust_file = system with tls_certcheck = on
and verifies the relay leaf CN=INFINITO.EXAMPLE Global TLS against
CN=infinito.example Root CA; pointing it at an unrelated CA fails as expected.
Inside the deployed wordpress container the rendered msmtprc now carries no
trust line and msmtp 1.8.28 (GnuTLS) resolves it to system.

On p11-kit distributions this widens the anchor set from the serverAuth
extraction to the unfiltered store rather than being neutral; no anchor is lost
on any supported distribution.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/sys-svc-mail-msmtp/tasks/ca_bundle.yml

@@ -1,19 +0,0 @@
----
-- name: 🔍 Probe CA bundle candidate paths for msmtp TLS trust file
-  ansible.builtin.stat:
-    path: "{{ item }}"
-  loop: "{{ SYS_SVC_MAIL_MSMTP_CA_BUNDLE_CANDIDATES }}"
-  register: _sys_svc_mail_msmtp_ca_probe
-
-- name: 🎯 Select first existing CA bundle path for msmtp
-  ansible.builtin.set_fact:
-    sys_svc_mail_msmtp_ca_bundle: >-
-      {{
-        (
-          _sys_svc_mail_msmtp_ca_probe.results
-          | selectattr('stat.exists')
-          | map(attribute='item')
-          | list
-          | first
-        ) | default(SYS_SVC_MAIL_MSMTP_CA_BUNDLE_CANDIDATES | first, true)
-      }}

roles/sys-svc-mail-msmtp/tasks/enable.yml

@@ -46,8 +46,6 @@
         force: true
       when: sys_svc_mail_msmtp_mta is skipped
 
-- include_tasks: ca_bundle.yml
-
 - name: 🔧 configure msmtprc.conf.j2
   template: # nocheck: stack-host-template (per-host /root/.msmtprc, not stack-host-only)
     src: "msmtprc.conf.j2"

roles/sys-svc-mail-msmtp/templates/msmtprc.conf.j2

@@ -6,7 +6,6 @@ syslog              {{ MODE_DEBUG | on_off }}
 auth                {{ email.auth | on_off }}
 tls_starttls        {{ email.start_tls | on_off }}
 tls                 {{ email.tls | on_off }}
-tls_trust_file      {{ sys_svc_mail_msmtp_ca_bundle }}
 tls_host_override   {{ email.host }}
 account             system_email_no_reply
 host                {{ lookup('smtp_host', email) }}

roles/sys-svc-mail-msmtp/vars/main.yml

@@ -1,7 +0,0 @@
----
-SYS_SVC_MAIL_MSMTP_CA_BUNDLE_CANDIDATES:
-  - /etc/pki/tls/certs/ca-bundle.crt
-  - /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
-  - /etc/ssl/certs/ca-certificates.crt
-  - /etc/ssl/cert.pem
-  - /etc/ssl/ca-bundle.pem

roles/web-app-moodle/tasks/02_build_context.yml

@@ -43,12 +43,6 @@
     - compose build
     - compose up
 
-- name: "🔧 Ensure msmtp CA-bundle fact is set before rendering msmtprc"
-  ansible.builtin.include_role:
-    name: sys-svc-mail-msmtp
-    tasks_from: ca_bundle
-  when: sys_svc_mail_msmtp_ca_bundle is not defined
-
 - name: "📋 Copy msmtprc to {{ MOODLE_MSMTP_ABS }} (Mailu relay for mail() + healthcheck)"
   stack_host_template:
     src: "{{ MOODLE_MSMTP_SRC }}"