Deliver the MusicMouse front-end even when a later role fails

The front-end build (npm ci, build, rsync, stamp) runs as handlers, and a failure in
any role after pi_musicmouse threw the queue away. On musicdolphin that left the
backend serving the API only, with no web/dist, across several runs. Flush the
handlers at the end of the role, so the front-end depends on this role succeeding and
not on every role after it.

Also install ffmpeg, which the backend needs to pull the audio out of podcast feeds
that publish video episodes ("Wissen macht Ah!"), and chromium.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/pi_musicmouse/tasks/main.yml

@@ -5,6 +5,8 @@
       - git
       - libvlc5 # runtime lib python-vlc binds against
       - vlc-plugin-base
+      - ffmpeg # podcast feeds that publish video episodes get their audio extracted with it
+      - chromium
       - alsa-utils
       - samba
       - python3
@@ -237,6 +239,15 @@
     name: smbd
     state: started
     enabled: true
+
+- name: Build, sync and restart now rather than at the end of the play
+  # Handlers only run once the whole play is through, and a failure in any later role
+  # (squeezelite, shairport, ...) throws the queue away. The .built-commit guard above
+  # re-queues the build on the next run, but a play that keeps failing elsewhere then
+  # never delivers a front-end at all: the backend serves the API only and the kiosk
+  # shows nothing. Flushing here ties the front-end to this role succeeding, not to
+  # every role after it.
+  ansible.builtin.meta: flush_handlers
 # manual steps:
 #    - set samba passwords with smbpasswd
 #    - copy music into /media/musicmouse: scripts/sync-library.sh in the app repo, which