Implement dynamic TimeoutStartSec filter for domains and update roles

- Added new filter plugin 'timeout_start_sec_for_domains' to calculate TimeoutStartSec based on number of domains.
- Updated sys-ctl-hlth-csp and sys-ctl-hlth-webserver tasks to use the filter.
- Removed obsolete systemctl.service.j2 in sys-ctl-hlth-csp.
- Adjusted variable naming (CURRENT_PLAY_DOMAINS_ALL etc.) in multiple roles.
- Updated srv-letsencrypt and sys-svc-certs to use uppercase vars.
- Switched pretix role to sys-stk-full-stateful and removed leftover javascript.js.
- Added unittests for the new filter under tests/unit/filter_plugins.

See conversation: https://chatgpt.com/share/68b1ae9a-1ac0-800f-b49d-2915386a1a23

tests/unit/filter_plugins/test_timeout_start_sec_for_domains.py

@@ -0,0 +1,87 @@
+# tests/unit/filter_plugins/test_timeout_start_sec_for_domains.py
+import unittest
+from ansible.errors import AnsibleFilterError
+from filter_plugins.timeout_start_sec_for_domains import FilterModule
+
+
+def _f():
+    return FilterModule().filters()["timeout_start_sec_for_domains"]
+
+
+class TestTimeoutStartSecForDomains(unittest.TestCase):
+
+    def test_basic_calculation_with_www(self):
+        # 3 unique base domains → + www.* = 6 domains
+        domains = {
+            "canonical": ["example.com", "foo.bar"],
+            "api": {"a": "api.example.com"},
+        }
+        result = _f()(domains, include_www=True,
+                      per_domain_seconds=25,
+                      overhead_seconds=30,
+                      min_seconds=120,
+                      max_seconds=3600)
+        # raw = 30 + 25 * 6 = 180
+        self.assertEqual(result, 180)
+
+    def test_no_www_min_clamp_applies(self):
+        # 3 unique domains, no www.* → raw = 30 + 25*3 = 105 → clamped to min=120
+        domains = {
+            "canonical": ["example.com", "foo.bar"],
+            "api": {"a": "api.example.com"},
+        }
+        result = _f()(domains, include_www=False,
+                      per_domain_seconds=25,
+                      overhead_seconds=30,
+                      min_seconds=120,
+                      max_seconds=3600)
+        self.assertEqual(result, 120)
+
+    def test_max_clamp_applies(self):
+        # >143 domains needed to exceed 3600 (25s each + 30 overhead)
+        many = [f"host{i}.example.com" for i in range(150)]
+        domains = {"canonical": many}
+        result = _f()(domains, include_www=False,
+                      per_domain_seconds=25,
+                      overhead_seconds=30,
+                      min_seconds=120,
+                      max_seconds=3600)
+        self.assertEqual(result, 3600)
+
+    def test_deduplication_of_domains(self):
+        # All entries resolve to "x.com" → only 1 unique domain
+        domains = {
+            "a": ["x.com", "x.com"],
+            "b": "x.com",
+            "c": {"k": "x.com"},
+        }
+        result = _f()(domains, include_www=False,
+                      per_domain_seconds=25,
+                      overhead_seconds=30,
+                      min_seconds=120,
+                      max_seconds=3600)
+        # raw = 30 + 25 * 1 = 55 → clamped to 120
+        self.assertEqual(result, 120)
+
+    def test_deduplication_with_www_variants(self):
+        # 2 unique base domains, one already includes a "www.a.com"
+        domains = {
+            "canonical": ["a.com", "b.com", "www.a.com"],
+            "extra": {"x": "a.com"},
+        }
+        result = _f()(domains, include_www=True,
+                      per_domain_seconds=25,
+                      overhead_seconds=30,
+                      min_seconds=1,
+                      max_seconds=10000)
+        # Unique: {"a.com","b.com","www.a.com","www.b.com"} → 4
+        # raw = 30 + 25*4 = 130
+        self.assertEqual(result, 130)
+
+    def test_raises_on_non_dict_input(self):
+        with self.assertRaises(AnsibleFilterError):
+            _f()(["not-a-dict"])
+
+
+if __name__ == "__main__":
+    unittest.main()