fix(ansible): deploy.yml has 3 bugs blocking tagged re-runs

Ansible deploy.yml Bugs

Bug 1: image_tag undefined in build play

File: deploy/ansible/deploy.yml
Line: 386 (Define image build list) references {{ image_tag }}
Problem: Get current git commit SHA (line 480) and Set image tag from git SHA (line 489) come AFTER the image build list definition. When Ansible evaluates genieai_images, image_tag is not yet defined.
Fix: Move the git SHA and image_tag tasks BEFORE Define image build list.

Bug 2: swarm_registry_url undefined in build play

File: deploy/ansible/deploy.yml
Line: 494 (Check if images need rebuild) references {{ swarm_registry_url }}
Problem: swarm_registry_url is only set in the Local Docker registry play (tagged [install]). When running with --tags build,deploy, the install-tagged play is skipped, so swarm_registry_url is undefined.
Fix: Add set_fact: swarm_registry_url to the build play (same pattern as deploy play line 570).

Bug 3: image_tag undefined in deploy play

File: deploy/ansible/deploy.yml
Line: env.j2 uses IMAGE_TAG={{ image_tag | default('latest') }}
Problem: The deploy play (tagged [deploy]) never sets image_tag. When running with --tags deploy alone, it defaults to latest, but images in the registry are tagged with git SHA. Swarm can't find localhost:5000/genie-ai-backend:latest — only localhost:5000/genie-ai-backend:3a675547 exists.
Fix: Add git SHA retrieval and image_tag set_fact to the deploy play.

Impact

These bugs prevent deploying to a new server using tagged re-runs (--tags build,deploy or --tags deploy), which is the documented workflow in deploy/ansible/README.md.

Reproduction

ansible-playbook -i inventory/cloud_deploy.ini deploy.yml --tags build,deploy --vault-password-file .vault-pass
# Fails: 'swarm_registry_url' is undefined / 'image_tag' is undefined