ansible.builtin.mount does not support changing mount propagation,
so command is suppressed with noqa rather than replaced with the module.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Add detect_platform.yml with a single `matrix_base_host_is_synology`
  boolean (null = autodetect, true/false = force); all Synology gates now
  use this variable instead of reaching into the raw stat result
- Make recursive chown conditional: stat the data path before any changes
  and only run `chown -R` (native binary, not Ansible file recurse) when
  uid/gid actually differs from expected
- Expose `matrix_base_synology_requests_version_constraint` so the
  requests<2.32 pin can be bumped without a code change
- Replace Python GID lookup with `synogroup --get` + regex_search,
  dropping the python3 dependency for that step
- Require `matrix_synology_user_password` (non-empty) and create the
  service account with expired=1 so it cannot be used to log in to DSM
- Apply `mount --make-shared /volume1` during setup so the first run
  no longer requires a manual step before starting services
- Use `devture_systemd_docker_base_host_command_docker` and
  `devture_systemd_docker_base_host_command_systemctl` in the boot-fix
  script instead of hardcoded paths
- Boot-fix now also restarts matrix-*.service units in `failed` state,
  not only `inactive`
- Update docs to reflect all of the above

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>