I'm not a representative of either of the companies you may have bought the hardware from, so their support may be able to assist, but in short:
Yes, reflashing the firmware/gateware is the only option to choose the DRTIO role (master/satellite) as well as to configure the Kasli for the connected hardware devices.
The system description JSON is what's relevant to build the firmware/gateware; the device_db is strictly for later runtime use of the host-side programs connecting to the Kasli. You can generate it quite easily if you have a Linux box with Vivado set up; see the ARTIQ documentation.
You can easily flash the new binaries using artiq_flash and the UART connection. Newer ARTIQ revisions do support flashing via artiq_coremgmt (and as such, across Ethernet connections and down a DRTIO tree over SFP), but this doesn't help you if you don't have a DRTIO master in the system.
-If device_db is needed for the binaries, each time we install a new module a new flashing is required?
As mentioned, the device_db doesn't influence the firmware/gateware (the connection is the other way round: it needs to match the settings they were built with), but yes, you'll need to rebuild/-flash the gateware every time you modify the EEM modules used.