fix(mastodon): distribute the force_ssl override and give migrate its volumes

Two independent defects kept mastodon_mastodon from converging; either alone
leaves the stack red.

meta/volumes.yml declared force_ssl_override as type: bind pointing at a host
path, but tasks/01_overrides.yml writes that file with plain file/copy and no
delegate_to, so it exists only where the play ran. Every worker placement was
refused before container create:

  Shutdown Rejected  invalid mount config for type "bind": bind source path
                     does not exist: .../overrides/zzz_disable_force_ssl.rb

type: config is the swarm-distributable form and what svc-dns-unbound,
web-app-listmonk, web-app-n8n and web-app-decidim already use for small
mounted files, each with mode 0444.

Separately, compose.yml.j2 rendered the migrate service as the only one
without with_volumes=true -- mastodon and sidekiq both pass it. So migrate
never received 00_oidc_http_discovery.rb, ran OIDC discovery over HTTPS at
boot and died with "tlsv1 unrecognized name". Fixing only the mount would
have unblocked placement and still left the stack short of converged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-mastodon/meta/volumes.yml

@@ -9,8 +9,9 @@ data:
       target: /mastodon/public/system
 
 force_ssl_override:
-  type: bind
+  type: config
   source: "{{ [lookup('container', 'web-app-mastodon', 'directories.instance'), 'overrides', 'zzz_disable_force_ssl.rb'] | path_join }}"
+  mode: "0444"
   mounts:
     - service: mastodon
       target: /opt/mastodon/config/initializers/zzz_disable_force_ssl.rb

roles/web-app-mastodon/templates/compose.yml.j2

@@ -34,7 +34,7 @@
 {{ mastodon_service(MASTODON_SERVICE_NAME, MASTODON_CONTAINER, 'mastodon', 'bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"', ports_key='http', with_volumes=true) }}
 {{ mastodon_service(MASTODON_STREAMING_SERVICE_NAME, MASTODON_STREAMING_CONTAINER, 'streaming', 'node ./streaming', ports_key='websocket') }}
 {{ mastodon_service(MASTODON_SIDEKIQ_SERVICE_NAME, MASTODON_SIDEKIQ_CONTAINER, 'mastodon', 'bundle exec sidekiq', with_volumes=true) }}
-{{ mastodon_service(MASTODON_MIGRATE_SERVICE_NAME, MASTODON_MIGRATE_CONTAINER, 'mastodon', 'bundle exec rails db:prepare', healthcheck=false, after_migrate=false, restart='on-failure') }}
+{{ mastodon_service(MASTODON_MIGRATE_SERVICE_NAME, MASTODON_MIGRATE_CONTAINER, 'mastodon', 'bundle exec rails db:prepare', healthcheck=false, after_migrate=false, restart='on-failure', with_volumes=true) }}
 
 {{ lookup('compose_volumes', application_id) }}
 {{ lookup('compose_networks') }}