write every file of the machine from the "system" action

write every file of the machine from the "system" action

The nginx configuration and the nftables rules were written by an ordinary
install, the systemd unit by "INSTALL.sh system", and the sysv script it
replaces had always been there. Three files that all belong to the machine
and not to the tree of the site, written from two different places.

They now all come from the "system" action, with the same options as the
install: the nginx configuration of the site, the nftables rules of the
daemon machine, and the way the daemon is started. An install writes none
of them. An install is run whenever the code changes; these follow the shape
of the machine, which changes almost never, and writing them every time only
risks overwriting a file somebody has since adapted.

What the action writes depends on the machine, as before: no nginx
configuration with -S apache, on a daemon machine (-m server) or in the
historic -D FALSE mode; no nftables rules unless the daemon is on tcp and -I
gives the address of the front; no daemon on a front, so no unit and no sysv
script there. Only the sysv script is still installed by the action itself,
being the one file that is of no use anywhere else; everything else is
written in Etc and the action ends with the list of what to copy where.

An install now says that the files of the machine come from "system". -h
lists the action. pool_size() reads the installed tree when the tree being
built is not there, which is the case in the action.

Checked in the container: an install of all three roles writes no file of
the machine, and the action writes, for -m full, the three nginx files and
the unit; for -m server, the nftables rules with the pool read from the
installed tree (8090-8099 plus 8100) and the unit; for -m front, the nginx
files alone. The unit passes systemd-analyze verify. nft is not installed
there, so the rules were checked with nft -c in the earlier commits, where
the generator was the same.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>