Add change-tracking and restart_necessary computation for:
- matrix-authentication-service (custom role in this repo)
- container-socket-proxy, traefik-certs-dumper, postgres, exim-relay,
  cinny, livekit-server (external roles, bumped in requirements.yml)

Wire all 7 services in group_vars to use their _restart_necessary variable
instead of hardcoded true.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>