fix: add explicit bool filters for Ansible 12 jinja2_native compatibility

[dguido]

Summary

• Add | bool filters to all boolean variable references in when: conditions and Jinja2 if statements across 31 files
• Ansible 12 enables jinja2_native by default, so string values "true"/"false" are no longer auto-coerced to booleans — bare when: ipsec_enabled silently evaluates truthy for any non-empty string
• Reformat long single-line Jinja2 conditionals into multi-line for readability (input.yml, users.yml, all cloud provider prompts)
• Fix GCE default() calls to pass true parameter (empty strings don't trigger default() in native mode)
• Add help|-h|--help command to the algo shell script
• Update test fixtures to register bool filter in Jinja2 environment
• Add j2lint (Jinja2 template linter) to pre-commit hooks, lint.yml CI, and smart-tests.yml — catches syntax errors, spacing issues, and operator formatting in .j2 templates

j2lint configuration

Rules ignored (incompatible with Ansible config-file-embedded templates):

Rule	Reason
S3 (indentation)	Output format dictates indentation, not Jinja style
S5 (no tabs)	Some config formats (strongswan.conf) require tabs
S6 (no {%-/-%})	Whitespace-control delimiters are standard Ansible
S7 (single statement per line)	Inline Jinja is necessary for config output
V1 (lowercase variables)	Existing names like IP_subject_alt_name

Affected areas

Area	Files	Change
Firewall templates	rules.v4.j2, rules.v6.j2	| bool on ipsec_enabled, wireguard_enabled, snat_aipv4, alternative_ingress_ip
Server playbook	server.yml	| bool on cloudinit, wireguard_enabled, ipsec_enabled, algo_dns_adblocking, dns_encryption, algo_ssh_tunneling
DNS role	dns/tasks/main.yml, dns/handlers/main.yml, templates	| bool on is_debian_based, uses_systemd_socket, algo_dns_adblocking, ipv6_support
WireGuard role	wireguard/defaults/main.yml, tasks/main.yml, server.conf.j2	| bool on ipv6_support, is_debian_based; fix int+1 spacing
StrongSwan role	strongswan/defaults/main.yml, tasks/, ipsec.conf.j2	| bool on ipv6_support, algo_dns_adblocking, dns_encryption, is_debian_based
Cloud providers	All prompts.yml + main.yml	Multi-line Jinja2 reformatting, | bool on alternative_ingress_ip
Input/Users	input.yml, users.yml	Multi-line Jinja2 reformatting, | bool on ipsec_enabled, wireguard_enabled
Tests	test_iptables_rules.py, test_wireguard_key_generation.py	Register bool filter, rename unused var
CI/Tooling	lint.yml, smart-tests.yml, .pre-commit-config.yaml, pyproject.toml	Add j2lint to all lint pipelines

Test plan

• j2lint roles/ --ignore S3 S5 S6 S7 V1 — passed (0 errors)
• ansible-lint . — passed (production profile)
• yamllint . — passed
• ruff check . — passed
• shellcheck algo — passed
• actionlint .github/workflows/lint.yml .github/workflows/smart-tests.yml — passed
• ansible-playbook main.yml --syntax-check — passed
• ansible-playbook users.yml --syntax-check — passed
• pytest tests/unit/ -q — 90 passed
• All pre-commit hooks passed (including new j2lint hook)

🤖 Generated with Claude Code