feat(web-app-wordpress): add idempotent single-site domain update via WP-CLI

- New task 04_update_domain.yml updates home/siteurl only when needed
- DB-wide search-replace (old → new), GUID-safe, precise, tables-with-prefix
- Normalizes http→https, strips trailing slashes, then flushes cache/rewrites
- Guarded by is_multisite()==0; multisite untouched
- Wired into main.yml with auto target URL via domains|get_url

Fixes post-domain-change mixed/CSP issues due to hard-coded old URLs.

https://chatgpt.com/share/689bac2d-3610-800f-b6f0-41dc79d13a14

roles/web-app-wordpress/tasks/04_update_domain.yml

@@ -0,0 +1,68 @@
+---
+# Updates WordPress single-site URLs and normalizes DB references.
+# Expects: wp_new_url (passed from main.yml), wordpress_user/container/docker_html_path.
+
+- name: Get current 'home' URL
+  command: >
+    docker exec -u {{ wordpress_user }} {{ wordpress_container }}
+    wp option get home --path={{ wordpress_docker_html_path }}
+  register: wp_home
+  changed_when: false
+  failed_when: false
+
+- name: Get current 'siteurl'
+  command: >
+    docker exec -u {{ wordpress_user }} {{ wordpress_container }}
+    wp option get siteurl --path={{ wordpress_docker_html_path }}
+  register: wp_siteurl
+  changed_when: false
+  failed_when: false
+
+- name: Update 'home' (if needed)
+  vars:
+    wp_new_url_norm: "{{ wp_new_url | regex_replace('/+$','') }}"
+    wp_home_norm:    "{{ wp_home.stdout | regex_replace('/+$','') }}"
+  command: >
+    docker exec -u {{ wordpress_user }} {{ wordpress_container }}
+    wp option update home "{{ wp_new_url_norm }}" --path={{ wordpress_docker_html_path }}
+  when: wp_home_norm != wp_new_url_norm
+
+- name: Update 'siteurl' (if needed)
+  vars:
+    wp_new_url_norm:   "{{ wp_new_url | regex_replace('/+$','') }}"
+    wp_siteurl_norm:   "{{ wp_siteurl.stdout | regex_replace('/+$','') }}"
+  command: >
+    docker exec -u {{ wordpress_user }} {{ wordpress_container }}
+    wp option update siteurl "{{ wp_new_url_norm }}" --path={{ wordpress_docker_html_path }}
+  when: wp_siteurl_norm != wp_new_url_norm
+
+- name: Search-replace old → new URLs in DB (single site)
+  vars:
+    wp_old_url_norm: "{{ wp_home.stdout | regex_replace('/+$','') }}"
+    wp_new_url_norm: "{{ wp_new_url | regex_replace('/+$','') }}"
+  command: >
+    docker exec -u {{ wordpress_user }} {{ wordpress_container }}
+    wp search-replace "{{ wp_old_url_norm }}" "{{ wp_new_url_norm }}"
+    --skip-columns=guid --all-tables-with-prefix --precise
+    --path={{ wordpress_docker_html_path }}
+  register: wp_sr_domain
+  changed_when: "{{ ('Success: Made 0 replacements.' not in wp_sr_domain.stdout) | bool }}"
+
+- name: Normalize scheme to https if needed (http → https)
+  vars:
+    domain_only: "{{ (wp_new_url | regex_replace('^https?://','')) | regex_replace('/+$','') }}"
+    http_url:    "http://{{ domain_only }}"
+    https_url:   "https://{{ domain_only }}"
+  command: >
+    docker exec -u {{ wordpress_user }} {{ wordpress_container }}
+    wp search-replace "{{ http_url }}" "{{ https_url }}"
+    --skip-columns=guid --all-tables-with-prefix --precise
+    --path={{ wordpress_docker_html_path }}
+  register: wp_sr_scheme
+  changed_when: "{{ ('Success: Made 0 replacements.' not in wp_sr_scheme.stdout) | bool }}"
+
+- name: Flush caches and rewrite rules
+  command: >
+    docker exec -u {{ wordpress_user }} {{ wordpress_container }} bash -lc
+    "wp cache flush --path={{ wordpress_docker_html_path }} &&
+     wp rewrite flush --hard --path={{ wordpress_docker_html_path }}"