Fix remaining ansible-lint violations: file permissions, var-naming, package pinning

- risky-file-permissions (32): add explicit mode: to copy/template/file tasks,
  matching the umask-derived permissions they already had (0644 for configs
  and systemd units, 0755 for created directories) — no functional change.
- var-naming (28): prefix role-scoped vars with their role name across
  pi_dhtsensor, pi_dhtsensor_circuitpython, pi_shairport, pi_squeezelite,
  pi_squeezelite_custom, pi_sispmctl, pi_standard_setup, and pi_sysdweb's
  sysdweb_name (shared by 9 consuming roles). Updated every dependent
  template, task reference, and matching inventory.yml override, and
  verified resolved values with ansible-inventory before/after.
- Fixes a latent bug found while renaming: pi_standard_setup's "Get/Change
  WiFi country" tasks reused the name wifi_country for both the role default
  and a register, so the register silently clobbered the default before
  do_wifi_country ever read it. Split into distinct names so the intended
  default value is used.
- package-latest (2): pin docker-ce/docker-compose-plugin installs in
  server_debian_docker to state: present.
- no-handler (1): move pi_lirc's "Reboot if boot overlay changed" into a
  proper handler notified by the boot-overlay task.

ansible-lint now passes clean at the production profile.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

roles/pi_lirc/handlers/main.yml

@@ -0,0 +1,3 @@
+---
+- name: Reboot if boot overlay changed
+  ansible.builtin.reboot:

roles/pi_lirc/tasks/main.yml

@@ -6,31 +6,31 @@
   ansible.builtin.copy:
     src: lirc_options.conf
     dest: /etc/lirc/lirc_options.conf
+    mode: "0644"
 - name: Install config file lircd.conf
   ansible.builtin.copy:
     src: lircd.conf
     dest: /etc/lirc/lircd.conf
+    mode: "0644"
 - name: Install remote file
   ansible.builtin.copy:
     src: hauppauge.conf
     dest: /etc/lirc/hauppauge.conf
+    mode: "0644"
 - name: Activate overlay in boot config
   ansible.builtin.lineinfile:
     path: /boot/firmware/config.txt
     regexp: "^#?dtoverlay=gpio-ir"
     line: "dtoverlay=gpio-ir,gpio_pin=17"
-  register: boot_overlay
+  notify: Reboot if boot overlay changed
 - name: Restart lircd
   ansible.builtin.systemd:
     name: lircd
     state: started
     enabled: "yes"
     daemon_reload: "yes"
-- name: Reboot if boot overlay changed
-  ansible.builtin.reboot:
-  when: boot_overlay.changed
 - name: Add to sysdweb
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: lircd
+    pi_sysdweb_name: lircd