Refactor run-once orchestration and bootstrap Mailu/Mastodon in a single deploy

- Replace legacy utils/run_once.yml with the new helpers utils/once_flag.yml and utils/once_finalize.yml
- Introduce utils/compose_up.yml to ensure docker-compose stacks are up and to flush handlers safely without coupling to run-once flags
- Migrate all affected roles (desk-*, dev-*, sys-ctl-*, sys-svc-*, web-app-*, web-svc-*, util-*) to the new run-once helpers
- Rework sys-svc-msmtp to auto-load Mailu once per deploy, check reachability, and reuse the running stack instead of requiring multiple playbook passes
- Adjust web-app-mailu to integrate cert deployment, handler flushing, and run-once handling so Mailu is fully initialized in a single deploy
- Improve Matomo, CDN, logout and CSP/health-check related roles to cooperate with the new compose_up / once_* pattern
- Simplify alarm/backup/timer/service orchestration (sys-ctl-alm-*, sys-bkp-provider, sys-timer-cln-bkps, etc.) by moving run-once logic into dedicated 01_core.yml files
- Update integration tests so utils/once_flag.yml and utils/once_finalize.yml are recognised as valid run-once providers, keeping the global run_once_* guarantees consistent
- Align frontend injection and service dependencies so Mastodon- and Mailu-related services can be brought up coherently within a single deployment cycle rather than several iterations

roles/dev-shell/tasks/01_core.yml

@@ -0,0 +1,21 @@
+- name: Ensure ~/.bash_profile sources ~/.profile
+  lineinfile:
+    path: "$HOME/.bash_profile"
+    line: '[ -f ~/.profile ] && . ~/.profile'
+    insertafter: EOF
+    state: present
+    create: yes
+    mode: "0644"
+  become: false
+
+- name: Ensure ~/.zprofile sources ~/.profile
+  lineinfile:
+    path: "$HOME/.zprofile"
+    line: '[ -f ~/.profile ] && . ~/.profile'
+    insertafter: EOF
+    state: present
+    create: yes
+    mode: "0644"
+  become: false
+
+- include_tasks: utils/once_flag.yml

roles/dev-shell/tasks/main.yml

@@ -1,25 +1,2 @@
----
-- block:
-  - name: Ensure ~/.bash_profile sources ~/.profile
-    lineinfile:
-      path: "$HOME/.bash_profile"
-      line: '[ -f ~/.profile ] && . ~/.profile'
-      insertafter: EOF
-      state: present
-      create: yes
-      mode: "0644"
-    become: false
-
-  - name: Ensure ~/.zprofile sources ~/.profile
-    lineinfile:
-      path: "$HOME/.zprofile"
-      line: '[ -f ~/.profile ] && . ~/.profile'
-      insertafter: EOF
-      state: present
-      create: yes
-      mode: "0644"
-    become: false
-
-  - set_fact:
-      run_once_dev_shell: true
+- include_tasks: 01_core.yml
   when: run_once_dev_shell is not defined