Refactor run-once orchestration and bootstrap Mailu/Mastodon in a single deploy

- Replace legacy utils/run_once.yml with the new helpers utils/once_flag.yml and utils/once_finalize.yml
- Introduce utils/compose_up.yml to ensure docker-compose stacks are up and to flush handlers safely without coupling to run-once flags
- Migrate all affected roles (desk-*, dev-*, sys-ctl-*, sys-svc-*, web-app-*, web-svc-*, util-*) to the new run-once helpers
- Rework sys-svc-msmtp to auto-load Mailu once per deploy, check reachability, and reuse the running stack instead of requiring multiple playbook passes
- Adjust web-app-mailu to integrate cert deployment, handler flushing, and run-once handling so Mailu is fully initialized in a single deploy
- Improve Matomo, CDN, logout and CSP/health-check related roles to cooperate with the new compose_up / once_* pattern
- Simplify alarm/backup/timer/service orchestration (sys-ctl-alm-*, sys-bkp-provider, sys-timer-cln-bkps, etc.) by moving run-once logic into dedicated 01_core.yml files
- Update integration tests so utils/once_flag.yml and utils/once_finalize.yml are recognised as valid run-once providers, keeping the global run_once_* guarantees consistent
- Align frontend injection and service dependencies so Mastodon- and Mailu-related services can be brought up coherently within a single deployment cycle rather than several iterations

roles/web-app-mailu/tasks/01_core.yml

@@ -1,3 +1,5 @@
+- include_tasks: utils/once_flag.yml
+
 - name: Ensure MAILU_HOSTNAMES is a list with max 1 entry
   ansible.builtin.assert:
     that:
@@ -23,21 +25,18 @@
     dest: "{{ MAILU_RSPAMD_HOST_FILE }}"
     mode: "0644"
 
-- name: "Mailu Docker and Webserver Setup"
-  block:
-  - name: "load docker, db and proxy for {{ application_id }}"
-    include_role:
-      name: sys-stk-full-stateful
-    vars:
-      docker_compose_flush_handlers: true
-
-  - name: "Include Cert deploy service for '{{ role_name }}'"
-    include_role:
-      name: sys-ctl-mtn-cert-deploy
+- name: "load docker, db and proxy for {{ application_id }}"
+  include_role:
+    name: sys-stk-full-stateful
   vars:
+    docker_compose_flush_handlers: true
     domain: "{{ MAILU_HOSTNAME }}"
 
-- name: Flush docker service handlers
+- name: "Include Cert deploy service for '{{ role_name }}'"
+  include_role:
+    name: sys-ctl-mtn-cert-deploy
+
+- name: "Flush Docker Compose handlers"
   meta: flush_handlers
 
 - name: "Create Mailu accounts"
@@ -67,5 +66,3 @@
 
 - name: Set Mailu DNS records
   include_tasks: 05_dns-records.yml
-
-- include_tasks: utils/run_once.yml

roles/web-app-mailu/tasks/03b_create_user_token.yml

@@ -51,15 +51,3 @@
           }, recursive=True)
       }}
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: "Reset MSMTP Configuration if No-Reply User Token changed"
-  when: users['no-reply'].username == mailu_user_name
-  block:
-    - name: "Set MSMTP run-once fact false"
-      set_fact:
-        run_once_sys_svc_msmtp: false
-      changed_when: false
-
-    - name: Reload MSMTP role
-      include_role:
-        name: "sys-svc-msmtp"