Mirror the pattern Slavi introduced for matrix-coturn (aafa8f0) across the
fork: every 'Ensure X container network is created' task gets a
'when: <var> not in ["", "host"]' guard so MDAD does not try to
docker_network create a network literally named 'host' (returns 403,
since host is a pre-defined Docker network).

Mirror the same guard in every systemd unit template that does
'ExecStartPre=docker network connect <addnet> <container>' loops over
matrix_<role>_container_additional_networks: skip the connects when the
container is on host networking (where additional --network attaches
are invalid).

Unblocks DiD setups where MDAD-managed containers share their host's
network namespace (matrix-mdad outer compose service joined to central
postgres/openldap networks) to reach external services on the outer
Docker daemon.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Replaces `community.docker.docker_image` with the modern
`docker_image_pull` module. Drops the `ansible_version` compatibility
ladder and the now-redundant `_container_image_force_pull` variable
(the new pull module handles registry refresh natively via `pull: always`).

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5191.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5051

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

When no identity server is configured, `matrix_client_element_default_is_url`
defaults to `~` (YAML null). The `| string | to_json` filter chain converts
this to the literal string `"None"`, causing Element Web to log errors:

- TypeError: URL constructor: None is not a valid URL
- Invalid base_url for m.identity_server

The well-known template (`.well-known/matrix/client.j2`) already handles
this correctly with a conditional guard (see PR #314). This applies the
same pattern to the Element Web `config.json.j2` template.

Roles affected: appservice-discord, appservice-irc, beeper-linkedin,
heisenbridge, hookshot, mautrix-bluesky, mautrix-discord,
mautrix-gmessages, mautrix-googlechat, mautrix-signal, mautrix-slack,
mautrix-twitter, mautrix-whatsapp, mautrix-wsproxy, mx-puppet-groupme,
mx-puppet-steam, postmoogle, sms, steam, cactus-comments, element,
fluffychat, schildichat, conduit, corporal, dendrite,
ldap-registration-proxy, media-repo, pantalaimon,
prometheus-nginxlog-exporter, registration, sygnal, synapse-admin,
user-verification-service.

For each role: renamed _docker_image* variables to _container_image*
(and _docker_src_files_path to _container_src_files_path where
applicable), added deprecation entries in validate_config.yml, and
updated group_vars/docs references.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

For each of the 34 roles (3 clients, 9 bots, 22 bridges), this commit:
- Adds `_restart_necessary: false` default variable
- Adds `register:` directives to config/image/systemd tasks
- Computes `_restart_necessary` via set_fact (OR of all .changed results)
- Wires `(_restart_necessary | bool)` in group_vars/matrix_servers

This allows the systemd service manager to skip unnecessary restarts
when running install-* tags and nothing actually changed.

Service roles and complex multi-service roles will follow separately.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

ansible-core>=2.19.0 only auto-parses YAML files, not JSON.

Previous ansible-core versions auto-parsed JSON as well, but ansible-core>=2.19.0
doesn't, so we added a `from_json` post-filter.
However, older versions auto-parsing JSON and turning it into a dict, on
which we later run `from_json` is no good.

In this patch, we try to equalize behavior and configure Ansible to never parse JSON,
hopefully making old-Ansible behave like new Ansible.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4458

Ref: https://docs.ansible.com/ansible/latest/collections/ansible/builtin/template_lookup.html#parameter-convert_data

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4445

It seems like ansible-core 2.19.0 no longer automatically parses template lookup content
as JSON (into a dict) when dealing with template files (be it `file.json.j2` or `file.j2`).

For files detected to contain YAML (`.ya?ml.j2`, but possibly others),
it automatically parses YAML, because the `convert_data` option
for the template lookup defaults to `true`.
Ref: https://docs.ansible.com/ansible/latest/collections/ansible/builtin/template_lookup.html

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4445

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4445

refers to commit
  e65d19884 Run Element Web in tightened/read-only mode without a custom nginx config

and issue
  https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4199