feat(mediawiki): Refactor OIDC + debug; install Composer deps in-container; modularize role

Discussion: https://chatgpt.com/share/68b10c0a-c308-800f-93ac-2ffb386cf58b

- Split tasks into 01_install, 02_debug, 03_admin, 04_extensions, 05_oidc.
- Ensure unzip+git+composer on demand in the container; run Composer as www-data with COMPOSER_HOME=/tmp/composer.
- Idempotently unpack/install PluggableAuth & OpenIDConnect; run composer install only if vendor/ is missing.
- Add sanity check for Jumbojett\OpenIDConnectClient.
- Copy oidc.php only when changed and append a single require_once to LocalSettings.php.
- Use REL1_44-compatible numeric array for $wgPluggableAuth_Config; set $wgPluggableAuth_ButtonLabelMessage.
- Debug: add debug.php that logs to STDERR (visible via docker logs); toggle cleanly with MODE_DEBUG.
- Enable OIDC feature in config; add paths/OIDC/extension vars in vars/main.yml.

fix(services): include SYS_SERVICE_GROUP_CLEANUP in StartPre lock (ssd-hdd, docker-hard).

fix(desktop/joomla): simplify MODE_DEBUG templating.

chore: minor cleanups and renames.

roles/web-app-mediawiki/tasks/02_debug.yml

@@ -0,0 +1,37 @@
+---
+# Aktiviert Debug, wenn MODE_DEBUG=true; entfernt es sauber, wenn false.
+
+- name: "DEBUG | Enable block when MODE_DEBUG=true"
+  when: MODE_DEBUG | bool
+  include_tasks: _enable_debug.yml
+
+- name: "DEBUG | Disable block when MODE_DEBUG=false"
+  when: not (MODE_DEBUG | bool)
+  block:
+    - name: "Remove require_once line from LocalSettings.php (if present)"
+      shell: |
+        docker exec -u {{ MEDIAWIKI_USER }} {{ MEDIAWIKI_CONTAINER }} bash -lc '
+          LSP={{ MEDIAWIKI_HTML_DIR }}/LocalSettings.php
+          if [ -f "$LSP" ]; then
+            if grep -Fqx -- "require_once __DIR__ . '\''/debug.php'\'';" "$LSP"; then
+              sed -i "\#require_once __DIR__ . '/debug.php';#d" "$LSP"
+              echo REMOVED_REQUIRE
+            fi
+          fi
+        '
+      args: { executable: /bin/bash }
+      register: _dbg_rm_req
+      changed_when: "'REMOVED_REQUIRE' in (_dbg_rm_req.stdout | default(''))"
+
+    - name: "Remove debug.php from container (if present)"
+      shell: >
+        docker exec {{ MEDIAWIKI_CONTAINER }} bash -lc
+        "if [ -f {{ MEDIAWIKI_HTML_DIR }}/debug.php ]; then rm -f {{ MEDIAWIKI_HTML_DIR }}/debug.php; echo REMOVED_FILE; fi"
+      args: { executable: /bin/bash }
+      register: _dbg_rm_file
+      changed_when: "'REMOVED_FILE' in (_dbg_rm_file.stdout | default(''))"
+
+    - name: "Remove local debug.php (if present)"
+      file:
+        path: "{{ MEDIAWIKI_CONFIG_DIR }}/debug.php"
+        state: absent