Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py.

- Update firewall scripts and shared conf files from firewall/ipt-server
  (HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
  mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
  fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
  fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
  fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
  fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
  rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
  bash variables, fall back to IPv6 for shared variables and warn if IPv4
  and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
  (<short-hostname>-ipt-server.yml) and new variables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/ipt-server/tasks/main.yml

@@ -107,6 +107,8 @@
     owner: root
     group: root
     mode: "0750"
+  notify:
+    - Restart IPv4 Firewall
 
 - name: Deploy ip6t-firewall-server
   copy:
@@ -115,6 +117,8 @@
     owner: root
     group: root
     mode: "0750"
+  notify:
+    - Restart IPv6 Firewall
 
 
 # ===
@@ -134,6 +138,11 @@
     - logging_ipv4.conf
     - logging_ipv6.conf
     - post_declarations.conf
+  # Shared files are sourced by both scripts; logging_ipv4/6 only by one,
+  # but restarting both keeps this simple.
+  notify:
+    - Restart IPv4 Firewall
+    - Restart IPv6 Firewall
 
 
 # ===