chore(vaultwarden,healthcheck): upgrade 1.37.2 (Bitwarden 2026.8+); fix vps-health checks

- vaultwarden/server:1.37.1 -> 1.37.2 (required for Bitwarden clients 2026.8.0+)
- compose probe: flag only active services (config --services) so debug-profile
  pgweb 'Exited' no longer false-positives
- runner: build aggregate args line-by-line (robust vs Jinja trim_blocks)
- SMTP AUTH probe moved host-side (vaultwarden image has no python3); never
  prints the SMTP password
- us2 facts: probe refresh 2026-08-29, image/version, vps-health install

ansible/roles/healthcheck/templates/health-common.sh.j2

@@ -31,9 +31,27 @@ compose_ps() {
 }
 
 check_compose() {
-  local output
-  output="$(compose_ps)" || { record critical 'compose_ps_failed'; return; }
-  if grep -qiE 'Exited|Restarting|[[:space:]]Dead[[:space:]]' <<<"$output"; then
+  local output services bad
+  # Only flag containers of *active* services (config --services excludes
+  # debug/profile-gated services such as vaultwarden's pgweb, which is
+  # intentionally stopped unless started with --profile debug).
+  services="$(docker compose --project-directory '{{ compose_project_dir }}' config --services 2>/dev/null)" || { record critical 'compose_ps_failed'; return; }
+  output="$(docker compose --project-directory '{{ compose_project_dir }}' ps --all --format json 2>&1)" || { record critical 'compose_ps_failed'; return; }
+  bad="$(printf '%s\n' "$output" | python3 -c '
+import json, sys
+services = set(sys.argv[1].split())
+for line in sys.stdin:
+    line = line.strip()
+    if not line:
+        continue
+    try:
+        c = json.loads(line)
+    except Exception:
+        continue
+    if c.get("Service") in services and c.get("State") in ("exited", "restarting", "dead"):
+        print(c.get("Service"))
+' "$services")"
+  if [[ -n "$bad" ]]; then
     record critical 'compose_unhealthy_container'
   else
     record ok 'compose_ok'