Refactor run-once orchestration and bootstrap Mailu/Mastodon in a single deploy

- Replace legacy utils/run_once.yml with the new helpers utils/once_flag.yml and utils/once_finalize.yml
- Introduce utils/compose_up.yml to ensure docker-compose stacks are up and to flush handlers safely without coupling to run-once flags
- Migrate all affected roles (desk-*, dev-*, sys-ctl-*, sys-svc-*, web-app-*, web-svc-*, util-*) to the new run-once helpers
- Rework sys-svc-msmtp to auto-load Mailu once per deploy, check reachability, and reuse the running stack instead of requiring multiple playbook passes
- Adjust web-app-mailu to integrate cert deployment, handler flushing, and run-once handling so Mailu is fully initialized in a single deploy
- Improve Matomo, CDN, logout and CSP/health-check related roles to cooperate with the new compose_up / once_* pattern
- Simplify alarm/backup/timer/service orchestration (sys-ctl-alm-*, sys-bkp-provider, sys-timer-cln-bkps, etc.) by moving run-once logic into dedicated 01_core.yml files
- Update integration tests so utils/once_flag.yml and utils/once_finalize.yml are recognised as valid run-once providers, keeping the global run_once_* guarantees consistent
- Align frontend injection and service dependencies so Mastodon- and Mailu-related services can be brought up coherently within a single deployment cycle rather than several iterations

roles/sys-svc-msmtp/tasks/01_core.yml

@@ -1,3 +1,25 @@
+- include_tasks: utils/once_flag.yml
+
+- name: "Check if Mail Host is reachable"
+  uri:
+    url: "{{ WEB_PROTOCOL ~ '://' ~ SYSTEM_EMAIL.HOST }}"
+    method: HEAD
+    validate_certs: yes
+    status_code: [200, 301, 302]
+  register: mail_host_reachability
+  failed_when: false
+  changed_when: false
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+  when: 
+    - run_once_web_app_mailu is not defined
+    - "{{ 'web-app-mailu' in group_names }}"
+    - SYSTEM_EMAIL.HOST == domains | get_domain('web-app-mailu')
+
+- name: "Load Mailu Routines for '{{ role_name }}'"
+  include_tasks: 02_mailu.yml
+  when: 
+    - mail_host_reachability is defined
+    - mail_host_reachability.status | default(0) not in [200, 301, 302]
 
 - name: install msmtp msmtp-mta
   community.general.pacman:
@@ -16,5 +38,4 @@
     name: sys-ctl-hlth-msmtp
   when: run_once_sys_ctl_hlth_msmtp is not defined
 
-- set_fact:
-    run_once_sys_svc_msmtp: true
+- include_tasks: utils/compose_up.yml

roles/sys-svc-msmtp/tasks/02_mailu.yml

@@ -0,0 +1,11 @@
+- name: "Load Mailu before MSMTP config, to guaranty that server is up"
+  include_role:
+    name: web-app-mailu
+    public: false
+  vars:
+    flush_handlers: true
+
+- name: "Reset compose handlers after Mailu include for MSMTP"
+  include_tasks: "{{ [ playbook_dir, 'tasks/utils/load_handlers.yml' ] | path_join }}"
+  vars:
+    handler_role_name: "docker-compose"

roles/sys-svc-msmtp/tasks/main.yml

@@ -1,6 +1,3 @@
 - name: "Load MSMTP Core Once"
   include_tasks: 01_core.yml
-  when:
-  - run_once_sys_svc_msmtp is not defined or run_once_sys_svc_msmtp is false
-  - users['no-reply'].mailu_token is defined
-  - not MODE_RESET | bool
+  when: not run_once_sys_svc_msmtp | default(false)