fix(web-app-mattermost): gate post-deploy tasks on IS_STACK_HOST

01_setup.yml and 02_keycloak.yml only contain shell tasks that exec
into MATTERMOST_CONTAINER / MATTERMOST_LDAP_CONTAINER /
MATTERMOST_KEYCLOAK_CONTAINER, which exist solely on STACK_HOST. On
swarm workers the chdir to the mattermost instance directory fails
during preprocessing, leaving mm_ready_wait as a module-failure dict
without .rc; the next "until: mm_ready_wait.rc == 0" then aborts with
"object of type 'dict' has no attribute 'rc'" at 0.4s, breaking the
swarm deploy for both workers.

Wrap both include_tasks in a single block gated on
"when: IS_STACK_HOST | bool" so workers skip the entire post-deploy
chain cleanly. The OIDC condition stays task-scoped on the keycloak
include and is ANDed with the inherited block gate at runtime.

The block-with-IS_STACK_HOST pattern is already used by
svc-bkp-container-2-local and web-app-pixelfed. Compose mode is
unaffected because IS_STACK_HOST evaluates true for non-swarm
deployments.

roles/web-app-mattermost/tasks/main.yml

@@ -11,9 +11,12 @@
   vars:
     compose_handlers_flush: true
 
-- name: "Run Mattermost setup routines"
-  include_tasks: 01_setup.yml
+- name: "Mattermost stack-host post-deploy"
+  when: IS_STACK_HOST | bool
+  block:
+    - name: "Run Mattermost setup routines"
+      include_tasks: 01_setup.yml
 
-- name: "Configure Keycloak OIDC mappers for Mattermost"
-  include_tasks: 02_keycloak.yml
-  when: MATTERMOST_OIDC_ENABLED | bool
+    - name: "Configure Keycloak OIDC mappers for Mattermost"
+      include_tasks: 02_keycloak.yml
+      when: MATTERMOST_OIDC_ENABLED | bool