refactor: idempotent role tasks + molecule idempotence gate

[FrankApiyo]

Summary

• Custom-template install compares the template repo's remote SHA against a .custom_template_version marker in the release dir and only reruns the git surgery on change.
• docs.pip install moved from shell to the pip module (idempotent); make html guarded by creates: on the built index; the ln -sfn sasl2 shell (which crashes outright on ubuntu2204 — no /usr/lib64) replaced with file module tasks that create the parent dir first.
• Molecule enforces the idempotence step, resolves the role under test by path (stale ~/.ansible/roles copies no longer shadow the checkout), and testinfra asserts the versioned-release marker.

Depends on onaio/ansible-django#52 — molecule/default/requirements.yml temporarily pins onaio.django to its branch. Do not merge until #52 merges and the pin is bumped to the merged SHA.

Test plan

• molecule test (ubuntu2204) against the django feature branch: fresh converge, idempotence rerun changed=0, testinfra 3/3
• Before merge: bump molecule/default/requirements.yml to the merged ansible-django SHA
• Staging: rerun with unchanged onadata_version reports ~0 changes

Follow-up (non-blocking): Set custom template facts raises an opaque Jinja error if onadata_custom_template_version matches no refs on the template repo — worth an explicit assert like the django role's version check.

Note: CI on master has been red since 2026-06-08 for unrelated reasons.