refactor: improve service handling and introduce MODE_ASSERT

- Improved get_service_name filter plugin (clearer suffix handling, consistent var names).
- Added MODE_ASSERT flag to optionally execute validation/assertion tasks.
- Fixed systemd unit handling: consistent use of %I instead of %i, correct escaping of instance names.
- Unified on_failure behavior and alarm composer scripts.
- Cleaned up redundant logging, handlers, and debug config.
- Strengthened sys-service template resolution with assert (only active when MODE_ASSERT).
- Simplified timer and suffix handling with get_service_name filter.
- Hardened sensitive tasks with no_log.
- Added conditional asserts across roles (Keycloak, DNS, Mailu, Discourse, etc.).

These changes improve consistency, safety, and validation across the automation stack.

Conversation: https://chatgpt.com/share/68a4ae28-483c-800f-b2f7-f64c7124c274

roles/svc-prx-openresty/handlers/main.yml

@@ -1,13 +1,4 @@
 ---
-- name: Wait until OpenResty container is running
-  command: docker inspect -f '{{.State.Running}}' {{ OPENRESTY_CONTAINER }}
-  register: openresty_status
-  retries: 10
-  delay: 3
-  until: openresty_status.stdout.strip() == "true"
-  changed_when: false
-  listen: restart openresty
-
 - name: Validate OpenResty configuration
   command: >
     docker exec {{ OPENRESTY_CONTAINER }} openresty -t -q