chore(vaultwarden,healthcheck): upgrade 1.37.2 (Bitwarden 2026.8+); fix vps-health checks

- vaultwarden/server:1.37.1 -> 1.37.2 (required for Bitwarden clients 2026.8.0+)
- compose probe: flag only active services (config --services) so debug-profile
  pgweb 'Exited' no longer false-positives
- runner: build aggregate args line-by-line (robust vs Jinja trim_blocks)
- SMTP AUTH probe moved host-side (vaultwarden image has no python3); never
  prints the SMTP password
- us2 facts: probe refresh 2026-08-29, image/version, vps-health install

ansible/roles/healthcheck/templates/vaultwarden.sh.j2

@@ -15,11 +15,12 @@ grep -Fq 'vw-db' <<<"$health" || record critical 'postgres_missing'
 check_https 'https://auth.wsvc.info/' '^200$'
 check_tls_days auth.wsvc.info 443
 
-# Read effective config only inside the service and report booleans/fingerprints,
-# never its SMTP password or other secret fields.
-smtp_result="$(docker compose --project-directory '{{ compose_project_dir }}' exec -T vaultwarden python3 - <<'PY' 2>&1
+# Read effective config from the mounted vw-data dir on the host and run the
+# SMTP AUTH probe from the host (the vaultwarden image has no python3; the
+# host does). Never print the SMTP password.
+smtp_result="$(python3 - <<'PY' 2>&1
 import json, pathlib, smtplib, ssl
-cfg=json.loads(pathlib.Path('/data/config.json').read_text())
+cfg=json.loads(pathlib.Path('{{ compose_project_dir }}/vw-data/config.json').read_text())
 host=cfg.get('smtp_host'); port=int(cfg.get('smtp_port') or 0)
 user=cfg.get('smtp_username')
 smtp_secret=cfg.get('smtp_password')