refactor: improve service handling and introduce MODE_ASSERT

- Improved get_service_name filter plugin (clearer suffix handling, consistent var names).
- Added MODE_ASSERT flag to optionally execute validation/assertion tasks.
- Fixed systemd unit handling: consistent use of %I instead of %i, correct escaping of instance names.
- Unified on_failure behavior and alarm composer scripts.
- Cleaned up redundant logging, handlers, and debug config.
- Strengthened sys-service template resolution with assert (only active when MODE_ASSERT).
- Simplified timer and suffix handling with get_service_name filter.
- Hardened sensitive tasks with no_log.
- Added conditional asserts across roles (Keycloak, DNS, Mailu, Discourse, etc.).

These changes improve consistency, safety, and validation across the automation stack.

Conversation: https://chatgpt.com/share/68a4ae28-483c-800f-b2f7-f64c7124c274

roles/sys-dns-hetzner-rdns/tasks/flavors/cloud.yml

@@ -14,6 +14,7 @@
     that: [ "_hz_token | length > 0" ]
     fail_msg: "HETZNER_API_TOKEN is required for the Cloud flavor."
   no_log: "{{ hetzner_no_log | bool }}"
+  when: MODE_ASSERT | bool
 
 - name: Collect hcloud servers if needed (server records without identifier)
   hetzner.hcloud.server_info:
@@ -61,6 +62,7 @@
         )
     fail_msg: "Could not resolve hcloud server by IPv4 for one or more records."
   no_log: "{{ hetzner_no_log | bool }}"
+  when: MODE_ASSERT | bool
 
 - name: Validate records (cloud)
   ansible.builtin.assert:
@@ -74,6 +76,7 @@
           + ((_rdns_records | default(rdns_records)) | rejectattr('resource','equalto','server') | list | length)
         ) == ((_rdns_records | default(rdns_records)) | length)
   no_log: "{{ hetzner_no_log | bool }}"
+  when: MODE_ASSERT | bool
 
 - name: Apply rDNS via hcloud
   hetzner.hcloud.hcloud_rdns:

roles/sys-dns-hetzner-rdns/tasks/flavors/robot.yml

@@ -7,6 +7,7 @@
       - (HETZNER_ROBOT_PASSWORD | default('') | length) > 0
     fail_msg: "Robot credentials required: HETZNER_ROBOT_USER / HETZNER_ROBOT_PASSWORD."
   no_log: "{{ hetzner_no_log | bool }}"
+  when: MODE_ASSERT | bool
 
 - name: Validate records (robot)
   ansible.builtin.assert:
@@ -16,6 +17,7 @@
       - (rdns_records | selectattr('dns_ptr','defined') | list | length) == (rdns_records | length)
     fail_msg: "Each record must have ip_address and dns_ptr for Robot rDNS."
   no_log: "{{ hetzner_no_log | bool }}"
+  when: MODE_ASSERT | bool
 
 - name: Apply rDNS via Hetzner Robot API
   vars: