refactor(systemd-services): migrate SYS_SERVICE_SUFFIX usage to get_service_name filter

Replaced all hardcoded service name concatenations with the new get_service_name filter.
This ensures consistency, proper lowercase formatting, and correct handling of '@' suffixed units.

Added unittests for the filter (normal, custom suffix, '@'-units, and lowercase normalization).

Context: see ChatGPT discussion https://chatgpt.com/share/68a38beb-b9bc-800f-b7ed-cdd2b64b2604

roles/sys-ctl-cln-certs/README.md

@@ -7,7 +7,7 @@ This Ansible role automates the detection, revocation and deletion of unused Let
 ## Overview
 
 - Installs the `certreap` cleanup tool using the `pkgmgr-install` role
-- Deploys and configures a `sys-ctl-cln-certs{{ SYS_SERVICE_SUFFIX }}` systemd unit
+- Deploys and configures a systemd unit
 - (Optionally) Sets up a recurring cleanup via a systemd timer using the `sys-timer` role
 - Integrates with `sys-ctl-alm-compose` to send failure notifications
 - Ensures idempotent execution with a `run_once_sys_ctl_cln_certs` flag
@@ -18,7 +18,7 @@ This Ansible role automates the detection, revocation and deletion of unused Let
   Uses `pkgmgr-install` to install the `certreap` binary.
 
 - **Systemd Service Configuration**  
-  Deploys `sys-ctl-cln-certs{{ SYS_SERVICE_SUFFIX }}` and reloads/restarts it on changes.
+  Deploys service and reloads/restarts it on changes.
 
 - **Systemd Timer Scheduling**  
   Optionally wires in a timer via the `sys-timer` role, controlled by the `on_calendar_cleanup_certs` variable.
@@ -27,7 +27,7 @@ This Ansible role automates the detection, revocation and deletion of unused Let
   Prevents multiple runs in one play by setting a `run_once_sys_ctl_cln_certs` fact.
 
 - **Failure Notification**  
-  Triggers `sys-ctl-alm-compose.infinito@sys-ctl-cln-certs{{ SYS_SERVICE_SUFFIX }}` on failure.
+  Triggers service on failure.
 
 ## Further Resources