refactor: improve service handling and introduce MODE_ASSERT

- Improved get_service_name filter plugin (clearer suffix handling, consistent var names).
- Added MODE_ASSERT flag to optionally execute validation/assertion tasks.
- Fixed systemd unit handling: consistent use of %I instead of %i, correct escaping of instance names.
- Unified on_failure behavior and alarm composer scripts.
- Cleaned up redundant logging, handlers, and debug config.
- Strengthened sys-service template resolution with assert (only active when MODE_ASSERT).
- Simplified timer and suffix handling with get_service_name filter.
- Hardened sensitive tasks with no_log.
- Added conditional asserts across roles (Keycloak, DNS, Mailu, Discourse, etc.).

These changes improve consistency, safety, and validation across the automation stack.

Conversation: https://chatgpt.com/share/68a4ae28-483c-800f-b2f7-f64c7124c274

roles/sys-ctl-alm-telegram/tasks/01_core.yml

@@ -8,6 +8,7 @@
       Please provide non‑empty values for:
         - telegram_bot_token   # Your Telegram bot’s API token
         - telegram_chat_id     # The Telegram chat ID to send messages to
+  when: MODE_ASSERT | bool
 
 - include_role:
     name: sys-service

roles/sys-ctl-alm-telegram/templates/systemctl@.service.j2

@@ -3,6 +3,6 @@ Description=status Telegram message for %i to user
 
 [Service]
 Type=oneshot
-ExecStart={{ system_service_script_exec }} %i
+ExecStart={{ system_service_script_exec }} %I
 User=root
 Group=systemd-journal