TLS cert-generation is triplicated in rotate-certs.yml — extract to one shared task file (DRY) #12181

The self-signed cert generation logic is not "one of a kind": ansible/playbooks/rotate-certs.yml copy-pastes an identical openssl req -x509 -nodes -days … -newkey rsa:2048 -keyout … -out … -subj … task plus its 0600 root:root key-permissions task three times — once each for the slm (L100), backend (L190), and frontend (L268) plays. Only the per-node vars (_key_file/_cert_file/_cert_subject/_cert_days) differ, and those are already set per play.

The repo already established the shared-TLS-task convention in #7272 (ansible/_shared/tasks/stat_tls_certs.yml, included by the backend + redis roles). Cert generation should follow the same pattern.

Audit result (not duplicated — distinct purposes, leave as-is)

• enable-tls.yml (Security Implementation - TLS Encryption & Secrets Management (Track 4) #164) — verifies certs exist + configures services; fails with guidance if missing. No cert-gen.
• deploy-certificate.yml — places a supplied cert on a node.
• distribute-tls-certs.yml (feat(security): Migrate services to mTLS authentication (PKI-based) #725) — distributes mTLS client certs; openssl used only for verify/inspect.
  These four playbooks are distinct lifecycle ops (enable / deploy / distribute-mTLS / rotate), not variant duplicates.

Fix

Extract the identical generate + set-permissions pair into ansible/_shared/tasks/generate_self_signed_cert.yml (consumers set _key_file/_cert_file/_cert_subject/_cert_days + a cert_label), and replace the three inline copies in rotate-certs.yml with include_tasks. Behavior-preserving.

Acceptance

• One shared cert-gen task file; rotate-certs.yml includes it 3× (no inline openssl duplication)
• yaml.safe_load valid; rotate-certs.yml behavior unchanged (same openssl invocation per node)