refactor: improve service handling and introduce MODE_ASSERT

- Improved get_service_name filter plugin (clearer suffix handling, consistent var names).
- Added MODE_ASSERT flag to optionally execute validation/assertion tasks.
- Fixed systemd unit handling: consistent use of %I instead of %i, correct escaping of instance names.
- Unified on_failure behavior and alarm composer scripts.
- Cleaned up redundant logging, handlers, and debug config.
- Strengthened sys-service template resolution with assert (only active when MODE_ASSERT).
- Simplified timer and suffix handling with get_service_name filter.
- Hardened sensitive tasks with no_log.
- Added conditional asserts across roles (Keycloak, DNS, Mailu, Discourse, etc.).

These changes improve consistency, safety, and validation across the automation stack.

Conversation: https://chatgpt.com/share/68a4ae28-483c-800f-b2f7-f64c7124c274

roles/sys-ctl-alm-email/templates/script.sh.j2

@@ -1,4 +1,10 @@
 #!/bin/bash
+set -u
+
+STATUS_OUT="$(systemctl status --full "$1" 2>/dev/null | head -n 30)"
+if [ -z "$STATUS_OUT" ]; then
+  STATUS_OUT="(no matching systemd unit found for: $1)"
+fi
 
 /usr/bin/sendmail -t <<ERRMAIL
 To: {{ users.administrator.email }}
@@ -7,9 +13,8 @@ Subject: $1
 Content-Transfer-Encoding: 8bit
 Content-Type: text/plain; charset=UTF-8
 
-A problem with the service $1 occured:
-
-$(systemctl status --full "$1" | head -n 30)
+A problem with the service $1 occurred:
 
+$STATUS_OUT
 
 ERRMAIL