refactor(configuration): consolidate firewall into one phase-aware path

roles/global_defaults/defaults/main.yml

@@ -132,7 +132,7 @@ system_defaults:
       enabled: true
     firewall:
       enabled: true
-      backend: "firewalld" # firewalld|ufw
+      backend: "" # '' -> family default (EL/arch=firewalld, debian/ubuntu=ufw); override: firewalld|ufw
       toolkit: "nftables" # nftables|iptables
     ssh:
       enabled: true