fix(web-svc-xmpp): give the image-declared parent path a named volume

The ejabberd image declares VOLUME /opt/ejabberd, and the role mounted only the four child paths below it, so docker materialised an anonymous volume for the parent on every deploy. sys-ctl-hlth-volumes flags exactly that and is right to: its whitelist keys on volume ids, which are random per deploy, so suppressing it was never possible. The unit therefore exited non-zero, sys-service-terminator retried it 25 times over 26 minutes and the deploy failed. A named ejabberd_home now covers the parent. It carries no backup because every stateful path is already a child volume, and it stays off NFS because the content is what the image seeds into that directory, which an NFS-rewritten volume would replace with an empty mount.

On an existing host the first deploy after this swaps the anonymous volume for the named one, so the erlang cookie regenerates; mnesia is keyed on the node name rather than the cookie. The orphan is then reaped by sys-ctl-cln-anon-volumes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-svc-xmpp/meta/volumes.yml

@@ -1,4 +1,13 @@
 ---
+home:
+  type: volume
+  name: ejabberd_home
+  backup: false
+  # nocheck: nfs-false-data-loss  Reason: carries only what the image seeds into /opt/ejabberd - the bin symlink, the ejabberd-contrib sources and the erlang cookie ejabberdctl regenerates; every path holding deployment state is a child volume of its own, and a fresh node reseeds this one from the image
+  nfs: false
+  mounts:
+    - service: ejabberd
+      target: /opt/ejabberd
 data:
   type: volume
   name: ejabberd_data