refactor: improve service handling and introduce MODE_ASSERT

- Improved get_service_name filter plugin (clearer suffix handling, consistent var names).
- Added MODE_ASSERT flag to optionally execute validation/assertion tasks.
- Fixed systemd unit handling: consistent use of %I instead of %i, correct escaping of instance names.
- Unified on_failure behavior and alarm composer scripts.
- Cleaned up redundant logging, handlers, and debug config.
- Strengthened sys-service template resolution with assert (only active when MODE_ASSERT).
- Simplified timer and suffix handling with get_service_name filter.
- Hardened sensitive tasks with no_log.
- Added conditional asserts across roles (Keycloak, DNS, Mailu, Discourse, etc.).

These changes improve consistency, safety, and validation across the automation stack.

Conversation: https://chatgpt.com/share/68a4ae28-483c-800f-b2f7-f64c7124c274

filter_plugins/get_service_name.py

@@ -15,8 +15,8 @@ Suffix handling:
 """
 
 def get_service_name(systemctl_id, software_name, suffix=""):
-    sid = str(systemctl_id).strip().lower()
-    sw  = str(software_name).strip().lower()
+    sid           = str(systemctl_id).strip().lower()
+    software_name = str(software_name).strip().lower()
 
     # Determine suffix
     if suffix is False:
@@ -24,14 +24,13 @@ def get_service_name(systemctl_id, software_name, suffix=""):
     elif suffix == "" or suffix is None:
         sfx = ".service"
     else:
-        sfx = "." + str(suffix).strip().lower()
+        sfx = str(suffix).strip().lower()
 
     if sid.endswith("@"):
         base = sid[:-1]  # drop the trailing '@'
-        return f"{base}.{sw}@{sfx}"
+        return f"{base}.{software_name}@{sfx}"
     else:
-        return f"{sid}.{sw}{sfx}"
-
+        return f"{sid}.{software_name}{sfx}"
 
 class FilterModule(object):
     def filters(self):