Run repository retention either after a successful backup or from a
dedicated systemd timer. Clean up script generation with templates and
expand molecule test coverage.

BREAKING CHANGE: Aggregate backup scripts are no longer managed, and
state=preset now requires at least one readable included directory.

Adds option to choose a non-default borg backup user on the server.

Add borg_ssh_key_per_repo option to generate unique SSH keypairs per
(server, repo) combination. When enabled, each repository gets its own
authorized_keys entry, enabling:

- Independent --append-only settings per repository
- Per-repo storage quotas

The blockinfile marker was only keyed by borg_server_host_url, causing
backup blocks to overwrite each other when running the role multiple
times on the same host with different repositories.

This change includes borg_repo_name in the marker, allowing multiple
backup blocks to coexist in the base script. Now running the role
twice with different borg_repo_name values creates separate blocks
instead of overwriting.

This ensures idempotent behavior and allows the base script to
accumulate all backup targets as documented.

Before: marker for "borg-server" (overwrites on second run)
After:  marker for "borg-server/configs" and "borg-server/home-data"

If passphrase contains special characters like (!, $, &, ^, *, @), this needs to be escaped.

Co-authored-by: Colin Wilk <colin@wilk.cx>

Systemd gives us the ability to monitor backup job status using existing
monitoring solutions (node exporter) and allows us greater control over
the scheduling of the backup jobs.

This introduces a breaking change that requires users to manually remove
the old repositories from the clients and redeploying them with the
role. You will have to remove the Cron job that was created by the
Ansible script, everything else will be overwritten with a run from the
newer version.

- name: Remove backup cron jobs
  ansible.builtin.cron:
    name: BORG (Application level backups)
    state: absent
  become: true
- name: Remove env for backup cron job
  ansible.builtin.cron:
    name: BORG_PASSPHRASE
    env: true
    state: absent
  become: true

Performing manual migrations on the Borg server is not required.

We now additionally support multiple Borg repositories per client host
using the `borg_backup_argument` variable.

Signed-off-by: Colin Wilk <colin.wilk@tum.de>