fix(web-app-keycloak): map only the rbac apps whose LDAP groups this host wrote

The per-app mapper payloads covered every rbac app of the current run,
and the run follows APPLICATIONS_WHITELIST across all hosts, while the
LDAP role groups and the purge keep-set follow this host's group_names.
On a multi-host swarm, svc-bkp-nfs-2-local (placed on the NFS host) got
a mapper without any LDAP group; its sync dropped the Keycloak groups,
hit ModelDuplicateException and answered HTTP 400 (Searxng#0).

The payloads now iterate the run apps this host also deploys, in run
order. The realm path without LDAP keeps the full run set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/web-app-keycloak/tasks/update/05_per_app_mappers.yml

@@ -34,7 +34,7 @@
       all_deployed: "{{ KEYCLOAK_RBAC_ALL_APP_IDS }}"
       current_run: "{{ KEYCLOAK_RBAC_RUN_APP_IDS }}"
 
-- name: "📄 per-app mappers: render the mapper payloads of every rbac app in current run"
+- name: "📄 per-app mappers: render the payloads of the rbac apps this host deploys"
   ansible.builtin.copy:
     dest: "{{ KEYCLOAK_PER_APP_LDAP_ROLES_MAPPER_PAYLOADS_FILE }}"
     mode: "0600"

roles/web-app-keycloak/vars/main.yml

@@ -50,9 +50,9 @@ KEYCLOAK_PER_APP_LDAP_ROLES_MAPPER_BASE: >-
                     }),
       })
   }}
-# One `<app_id> <mapper_name> <base64 mapper JSON> <fingerprint>` line per rbac app of the current run.
+# One `<app_id> <mapper_name> <base64 mapper JSON> <fingerprint>` line per rbac app of the current run that this host deploys.
 KEYCLOAK_PER_APP_LDAP_ROLES_MAPPER_PAYLOADS: |-
-  {% for app_id in KEYCLOAK_RBAC_RUN_APP_IDS -%}
+  {% for app_id in KEYCLOAK_RBAC_RUN_APP_IDS | select('in', KEYCLOAK_RBAC_ALL_APP_IDS) -%}
   {%- set mapper = KEYCLOAK_PER_APP_LDAP_ROLES_MAPPER_BASE | combine({
         'name': app_id | kc_per_app_mapper_name,
         'config': {