Add conditional restart support to remaining services

Add change-tracking and restart_necessary computation for:
- matrix-authentication-service (custom role in this repo)
- container-socket-proxy, traefik-certs-dumper, postgres, exim-relay,
  cinny, livekit-server (external roles, bumped in requirements.yml)

Wire all 7 services in group_vars to use their _restart_necessary variable
instead of hardcoded true.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

roles/custom/matrix-authentication-service/defaults/main.yml

@@ -654,6 +654,16 @@ matrix_authentication_service_migration_in_progress: false
 # Ref: https://element-hq.github.io/matrix-authentication-service/topics/admin-api.html#enabling-the-api
 matrix_authentication_service_admin_api_enabled: false
 
+# matrix_authentication_service_restart_necessary controls whether the service
+# will be restarted (when true) or merely started (when false) by the
+# systemd service manager role (when conditional restart is enabled).
+#
+# This value is automatically computed during installation based on whether
+# any configuration files, the systemd service file, or the container image changed.
+# The default of `false` means "no restart needed" — appropriate when the role's
+# installation tasks haven't run (e.g., due to --tags skipping them).
+matrix_authentication_service_restart_necessary: false
+
 ########################################################################################
 #                                                                                      #
 # /Misc                                                                                #