fix(bridge,litellm): use apt on Debian so module_defaults lock_timeout renders

The runtime plays set module_defaults.apt.lock_timeout to a templated value.
When a prerequisite task uses ansible.builtin.package (which dispatches to apt
on Debian), that templated default is NOT rendered and the literal
'{{ ai_workspace_apt_lock_timeout | default(900) | int }}' reaches apt ->
'lock_timeout is of type str ... cannot be converted to an int' -> the whole
on-host bootstrap aborts at the xworkmate-bridge prereq, before litellm/qmd
ever deploy (hence they were never up).

Fix: install prereqs via ansible.builtin.apt on Debian/Ubuntu (template renders
like every other apt task); keep ansible.builtin.package for non-Debian Linux
(dispatches to yum/dnf, which doesn't inherit the apt default).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/vhosts/litellm/tasks/main.yml

@@ -1,7 +1,21 @@
 ---
 # Provision the litellm database and user BEFORE litellm starts.
 # Only runs when litellm_database_host is set.
-- name: Install LiteLLM prerequisites (Linux)
+# Debian/Ubuntu 显式走 apt：play 的 module_defaults.apt.lock_timeout(模板值)只有在
+# apt 任务上才渲染；经 package 间接派发到 apt 时模板不渲染 → lock_timeout 收到字面
+# "{{ ... }}" 报 int 转换失败（见 xworkmate_bridge 同类修复）。
+- name: Install LiteLLM prerequisites (Debian/Ubuntu via apt)
+  ansible.builtin.apt:
+    name:
+      - python3
+      - python3-pip
+      - python3-venv
+      - python3-psycopg2
+    state: present
+    update_cache: true
+  when: ansible_os_family == 'Debian'
+
+- name: Install LiteLLM prerequisites (non-Debian Linux)
   ansible.builtin.package:
     name:
       - python3
@@ -9,7 +23,7 @@
       - python3-venv
       - python3-psycopg2
     state: present
-  when: ansible_os_family != 'Darwin'
+  when: ansible_os_family not in ['Darwin', 'Debian', 'Windows']
 
 - name: Install LiteLLM prerequisites (macOS)
   # Use brew from PATH (Apple Silicon prefix first) instead of the

roles/vhosts/xworkmate_bridge/tasks/main.yml

@@ -1,9 +1,20 @@
 ---
-- name: Install xworkmate-bridge prerequisites
+# Debian/Ubuntu 显式走 apt：play 的 module_defaults.apt.lock_timeout(模板值)只有
+# 在 ansible.builtin.apt 任务上才会被正确渲染；经 ansible.builtin.package 间接派发到
+# apt 时该模板不渲染，会把字面 "{{ ... }}" 当成 lock_timeout 传入而报 int 转换失败。
+- name: Install xworkmate-bridge prerequisites (Debian/Ubuntu via apt)
+  ansible.builtin.apt:
+    name: "{{ xworkmate_bridge_packages }}"
+    state: present
+    update_cache: true
+  when: ansible_os_family == 'Debian'
+
+# 非 Debian Linux 仍用通用 package(派发到 yum/dnf，不继承 apt 的 lock_timeout 默认)
+- name: Install xworkmate-bridge prerequisites (non-Debian Linux)
   ansible.builtin.package:
     name: "{{ xworkmate_bridge_packages }}"
     state: present
-  when: ansible_os_family != 'Darwin'
+  when: ansible_os_family not in ['Darwin', 'Debian', 'Windows']
 
 - name: Ensure xworkmate-bridge service group exists
   ansible.builtin.group: