Fix remaining ansible-lint violations: file permissions, var-naming, package pinning

- risky-file-permissions (32): add explicit mode: to copy/template/file tasks,
  matching the umask-derived permissions they already had (0644 for configs
  and systemd units, 0755 for created directories) — no functional change.
- var-naming (28): prefix role-scoped vars with their role name across
  pi_dhtsensor, pi_dhtsensor_circuitpython, pi_shairport, pi_squeezelite,
  pi_squeezelite_custom, pi_sispmctl, pi_standard_setup, and pi_sysdweb's
  sysdweb_name (shared by 9 consuming roles). Updated every dependent
  template, task reference, and matching inventory.yml override, and
  verified resolved values with ansible-inventory before/after.
- Fixes a latent bug found while renaming: pi_standard_setup's "Get/Change
  WiFi country" tasks reused the name wifi_country for both the role default
  and a register, so the register silently clobbered the default before
  do_wifi_country ever read it. Split into distinct names so the intended
  default value is used.
- package-latest (2): pin docker-ce/docker-compose-plugin installs in
  server_debian_docker to state: present.
- no-handler (1): move pi_lirc's "Reboot if boot overlay changed" into a
  proper handler notified by the boot-overlay task.

ansible-lint now passes clean at the production profile.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

inventory.yml

@@ -11,11 +11,11 @@ all:
         octopi:
           sensor_room_name_ascii: prusaprinter
           sensor_room_name: prusaprinter
-          dht_pin: 26
+          pi_dhtsensor_dht_pin: 26
           main_user: root
         bedroompi:
           squeezelite_name: BedroomPi
-          shairport_name: BedroomPi
+          pi_shairport_name: BedroomPi
           alsa_card_name: Codec
           sensor_room_name_ascii: schlafzimmer
           sensor_room_name: Schlafzimmer
@@ -24,7 +24,7 @@ all:
           main_user: root
         kitchenpi:
           squeezelite_name: KitchenPi
-          shairport_name: KitchenPi
+          pi_shairport_name: KitchenPi
           alsa_card_name: 0
           sensor_room_name_ascii: kueche
           sensor_room_name: Küche
@@ -32,15 +32,15 @@ all:
           main_user: root
         esszimmerradio: # oben, eltern
           squeezelite_name: Esszimmer
-          shairport_name: _Oben_Esszimmer
+          pi_shairport_name: _Oben_Esszimmer
           # alsa_card_name: Device
-          squeezeserver: 192.168.178.100
+          pi_squeezelite_squeezeserver: 192.168.178.100
           configure_wifi: true
           alsa_card_name: 1
           main_user: root
         musikserverwohnzimmeroben: # oben, eltern
           squeezelite_name: Wohnzimmer
-          shairport_name: _Oben_Wohnzimmer
+          pi_shairport_name: _Oben_Wohnzimmer
           alsa_card_name: sndrpihifiberry
           sensor_room_name_ascii: wohnzimmeroben
           sensor_room_name: WohnzimmerOben
@@ -48,7 +48,7 @@ all:
           main_user: root
         musicmouse:
           squeezelite_name: MusicMouse
-          shairport_name: MusicMouse
+          pi_shairport_name: MusicMouse
           alsa_card_name: sndrpihifiberry
           hifiberry_overlay: hifiberry-dacplus
           sensor_room_name: Kinderzimmer
@@ -56,7 +56,7 @@ all:
           main_user: root
         newrpi:
           squeezelite_name: MyTestRaspberry
-          shairport_name: MyTestRaspberry
+          pi_shairport_name: MyTestRaspberry
           alsa_card_name: 0
           sensor_room_name_ascii: testraum
           sensor_room_name: Test Raum
@@ -73,12 +73,12 @@ all:
   vars:
     ansible_user: root
     ansible_python_interpreter: /usr/bin/python3
-    squeezeserver: 192.168.178.80
+    pi_squeezelite_squeezeserver: 192.168.178.80
     router_ip: 192.168.178.1
     home_assistant_url: https://ha.bauer.tech
     home_assistant_token:
       eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkM2QxYjAwYjkxZjY0MWVhYjA4YmZhMDYwYTg3YjRhNyIsImlhdCI6MTcwNDI3MDU5MSwiZXhwIjoyMDE5NjMwNTkxfQ.dzvejgEQd9hf-Yftzd7NkR5pv76GaLFczeOy-a2pa1o
     configure_wifi: false
-    wifi_ssid: BauerWLAN
+    pi_standard_setup_wifi_ssid: BauerWLAN
     my_btmonitor_mqtt_username: my_btmonitor
     my_btmonitor_mqtt_password: 8aBIAC14jaKKbla