Understand systemctl disable vs mask vs stop, and fix 'Unit is masked' errors

Documented steps

1. `systemctl stop myapp` stops the running process now; it says nothing about the next boot. `systemctl disable myapp` removes the [Install] symlinks so it will not auto-start at boot, but it can still be started manually or pulled in as a dependency of another unit.
2. `systemctl mask myapp` symlinks the unit to /dev/null in /etc/systemd/system — it cannot be started at all, manually or by dependency. Attempting gives: `Failed to start myapp.service: Unit myapp.service is masked.`
3. Use mask to hard-block a unit another package keeps pulling in (e.g. a distro service conflicting with your managed one). Combine actions: `systemctl disable --now myapp` (disable + stop in one step).
4. Temporary until reboot: `systemctl mask --runtime myapp` (symlink under /run/systemd/system).
5. Undo: `systemctl unmask myapp`, then `systemctl enable --now myapp` as desired. Check current state: `systemctl is-enabled myapp` prints enabled/disabled/masked/static/indirect.
6. State 'static' means the unit has no [Install] section — it cannot be enabled/disabled and is only started via dependency or manually; that is not an error.
7. Audit everything unusual: `systemctl list-unit-files --state=masked,enabled-runtime`.