refactor: improve service handling and introduce MODE_ASSERT

- Improved get_service_name filter plugin (clearer suffix handling, consistent var names).
- Added MODE_ASSERT flag to optionally execute validation/assertion tasks.
- Fixed systemd unit handling: consistent use of %I instead of %i, correct escaping of instance names.
- Unified on_failure behavior and alarm composer scripts.
- Cleaned up redundant logging, handlers, and debug config.
- Strengthened sys-service template resolution with assert (only active when MODE_ASSERT).
- Simplified timer and suffix handling with get_service_name filter.
- Hardened sensitive tasks with no_log.
- Added conditional asserts across roles (Keycloak, DNS, Mailu, Discourse, etc.).

These changes improve consistency, safety, and validation across the automation stack.

Conversation: https://chatgpt.com/share/68a4ae28-483c-800f-b2f7-f64c7124c274

roles/sys-ctl-alm-compose/templates/script.sh.j2

@@ -1,10 +1,11 @@
 #!/bin/bash
 err=0
 set -u
-{% for alarm_service in SYSTEMCTL_ALARM_COMPOSER_SUBSERVICES %}
-{% set alarm_service_full_name = alarm_service | get_service_name(SOFTWARE_NAME, '"$1".service') %}
-if ! /usr/bin/systemctl start {{ alarm_service_full_name }}; then
-  echo "ERROR: Failed to start {{ alarm_service_full_name }}" >&2
+{% for alarm in SYSTEMCTL_ALARM_COMPOSER_SUBSERVICES %}
+# sys-ctl-alm-email.infinito.nexus@<escaped>.service (no extra dot!)
+unit="{{ (alarm ~ '@') | get_service_name(SOFTWARE_NAME, False) }}$(systemd-escape "$1").service"
+if ! /usr/bin/systemctl start -- "$unit"; then
+  echo "ERROR: Failed to start $unit" >&2
   err=1
 fi
 {% endfor %}