Add conditional restart support to remaining services

Add change-tracking and restart_necessary computation for:
- matrix-authentication-service (custom role in this repo)
- container-socket-proxy, traefik-certs-dumper, postgres, exim-relay,
  cinny, livekit-server (external roles, bumped in requirements.yml)

Wire all 7 services in group_vars to use their _restart_necessary variable
instead of hardcoded true.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

roles/custom/matrix-authentication-service/tasks/install.yml

@@ -40,6 +40,7 @@
     mode: 0644
     owner: "{{ matrix_user_name }}"
     group: "{{ matrix_group_name }}"
+  register: matrix_authentication_service_config_result
 
 - name: Ensure Matrix Authentication Service support files created
   ansible.builtin.template:
@@ -61,6 +62,7 @@
     - src: "{{ role_path }}/templates/bin/mas-cli.j2"
       dest: "{{ matrix_authentication_service_bin_path }}/mas-cli"
       mode: '0755'
+  register: matrix_authentication_service_support_files_result
 
 - name: Ensure Matrix Authentication Service container image is pulled
   community.docker.docker_image:
@@ -69,10 +71,10 @@
     force_source: "{{ matrix_authentication_service_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_authentication_service_container_image_force_pull }}"
   when: "not matrix_authentication_service_container_image_self_build | bool"
-  register: result
+  register: matrix_authentication_service_container_image_pull_result
   retries: "{{ devture_playbook_help_container_retries_count }}"
   delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
+  until: matrix_authentication_service_container_image_pull_result is not failed
 
 - when: "matrix_authentication_service_container_image_self_build | bool"
   block:
@@ -105,3 +107,14 @@
     src: "{{ role_path }}/templates/systemd/matrix-authentication-service.service.j2"
     dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-authentication-service.service"
     mode: 0644
+  register: matrix_authentication_service_systemd_service_result
+
+- name: Determine whether Matrix Authentication Service needs a restart
+  ansible.builtin.set_fact:
+    matrix_authentication_service_restart_necessary: >-
+      {{
+        matrix_authentication_service_config_result.changed | default(false)
+        or matrix_authentication_service_support_files_result.changed | default(false)
+        or matrix_authentication_service_systemd_service_result.changed | default(false)
+        or matrix_authentication_service_container_image_pull_result.changed | default(false)
+      }}