Extracts the shared frontend service loader from sys-front-inj-all into
tasks/utils/load_services.yml and tasks/utils/_load_frontend_service.yml,
called once from tasks/stages/02_server.yml before web-svc and web-app
roles. This decouples service loading from per-app injection and makes
load order explicit via SERVICE_REGISTRY entry order. Updates docs,
comments, and adds an integration test enforcing the new SPOT.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sets inj_enabled.matomo=false when the Matomo token is empty so the NGINX
template skips body/head snippets and avoids 'matomo_site_id is undefined'.
Removes the explicit CDN load task — CDN is now covered by the generic
frontend service loader in 01_services.yml (loaded only when needed).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Splits injection logic into inject.yml and guards execution via main.yml
when the Matomo API token is empty (e.g. first deployment or bootstrap not
yet run). Documents the exception and its retry behaviour in
docs/contributing/code/exceptions.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
kevinveenbirkenbach
