sys-svc-dns: add apex A/AAAA records for SYS_SVC_DNS_BASE_DOMAINS via task_include

This update introduces apex (@) A and optional AAAA records for all base SLD domains.
The tasks were moved into a new 02_apex.yml file and are looped using
SYS_SVC_DNS_BASE_DOMAINS. CAA record loops were updated accordingly.
See details: https://chatgpt.com/share/68c385c3-1804-800f-8c78-8614bc853f77

roles/sys-svc-dns/tasks/02_apex.yml

@@ -0,0 +1,28 @@
+---
+- name: "Ensure A @ for {{ base_domain }}"
+  community.general.cloudflare_dns:
+    api_token:  "{{ CLOUDFLARE_API_TOKEN }}"
+    zone:       "{{ base_domain }}"
+    type:       A
+    name:       "@"
+    content:    "{{ networks.internet.ip4 }}"
+    proxied:    false
+    ttl:        1
+    state:      present
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
+
+- name: "Ensure AAAA @ for {{ base_domain }} (if IPv6 is global)"
+  community.general.cloudflare_dns:
+    api_token:  "{{ CLOUDFLARE_API_TOKEN }}"
+    zone:       "{{ base_domain }}"
+    type:       AAAA
+    name:       "@"
+    content:    "{{ networks.internet.ip6 }}"
+    proxied:    false
+    ttl:        1
+    state:      present
+  when:
+    - (networks.internet.ip6 | default('') | trim) != ''
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"