fix(user): keep the login banner off non-interactive stdout

sshd starts bash in a way that sources ~/.bashrc even for a single
remote command, and this file printed its banner unconditionally. Every
command Ansible runs over SSH therefore returned the banner on stdout, and a
task that parses its own output read that instead: the Matomo bootstrap
asserted on stdout='unknown': unknown terminal type., which is 
failing when there is no terminal to clear.

The deploy never saw it while the roles were installed over the container
connection, where no login shell is involved. Now that the applications are
deployed over the mesh, every such task reads the banner.

Reproduced and fixed against the rendered template: sourcing it
non-interactively with TERM=unknown printed the terminal error and the whole
banner before, and prints nothing now, while an interactive shell is
unchanged.

The narration comment above the colour block goes with it: the guard moved it
off the file header, where the comment lint allows it, into mid-code, where
it is what that lint calls narration.

roles/user/templates/bashrc.j2

@@ -1,6 +1,15 @@
 #!/bin/bash
 
-# Set color variables for the welcome text based on the current user
+# Exception: bash sources this file for a non-interactive shell too when sshd
+# starts it, so without this guard the banner below lands on the stdout of
+# every command Ansible runs over SSH. A task that parses its own output then
+# reads the banner instead -- starting with `clear` failing as "'unknown':
+# unknown terminal type." when there is no terminal to clear.
+case $- in
+*i*) ;;
+*) return ;;
+esac
+
 if [ "$USER" = "root" ]; then
     HEADER_COLOR="\033[1;31m"             # Bold red for root
 elif [ "$USER" = "administrator" ]; then