Add Nextcloud cloud storage role with split Redis caching strategy

## New Features

- **Nextcloud Role**: Complete cloud storage deployment using Podman Quadlet
  - FPM variant with Caddy reverse proxy and FastCGI
  - PostgreSQL database via Unix socket
  - Valkey/Redis for app-level caching and file locking
  - Automatic HTTPS with Let's Encrypt via Caddy
  - Dual-root pattern: Caddy serves static assets, FPM handles PHP

- **Split Caching Strategy**: Redis caching WITHOUT Redis sessions
  - Custom redis.config.php template for app-level caching only
  - File-based PHP sessions for stability (avoids session lock issues)
  - Prevents cascading failures from session lock contention
  - Documented in role README with detailed rationale

## Infrastructure Updates

- **Socket Permissions**: Update PostgreSQL and Valkey to mode 777
  - Required for containers that switch users (root → www-data)
  - Nextcloud container loses supplementary groups on user switch
  - Security maintained via password authentication (scram-sha-256, requirepass)
  - Documented socket permission architecture in docs/

- **PostgreSQL**: Export client group GID as fact for dependent roles
- **Valkey**: Export client group GID as fact, update socket fix service

## Documentation

- New: docs/socket-permissions-architecture.md
  - Explains 777 vs 770 socket permission trade-offs
  - Documents why group-based access doesn't work for user-switching containers
  - Provides TCP alternative for stricter security requirements

- Updated: All role READMEs with socket permission notes
- New: Nextcloud README with comprehensive deployment, troubleshooting, and Redis architecture documentation

## Configuration

- host_vars: Add Nextcloud vault variables and configuration
- site.yml: Include Nextcloud role in main playbook

## Technical Details

**Why disable Redis sessions?**

The official Nextcloud container enables Redis session handling via REDIS_HOST env var,
which causes severe performance issues:

1. Session lock contention under high concurrency (browser parallel asset requests)
2. Infinite lock retries (default lock_retries=-1) blocking FPM workers
3. Timeout orphaning: reverse proxy kills connection, worker keeps lock
4. Worker pool exhaustion: all 5 default workers blocked on same session lock
5. Cascading failure: new requests queue, more timeouts, more orphaned locks

Solution: Use file-based sessions (reliable, fast for single-server) while keeping
Redis for distributed cache and transactional file locking via custom config file.

This provides optimal performance without the complexity of Redis session debugging.

Tested: Fresh deployment on arch-vps (69.62.119.31)
Domain: https://cloud.jnss.me/

roles/nextcloud/templates/nextcloud.container

@@ -0,0 +1,44 @@
+[Unit]
+Description=Nextcloud Cloud Storage Container (FPM)
+After=network-online.target postgresql.service valkey.service
+Wants=network-online.target
+
+[Container]
+ContainerName=nextcloud
+Image={{ nextcloud_image }}:{{ nextcloud_version }}
+EnvironmentFile={{ nextcloud_home }}/.env
+
+# Note: Container runs as root initially for entrypoint scripts,
+# then switches to www-data (UID 33) for PHP-FPM process.
+# This is the default behavior of the official Nextcloud image.
+# Socket access works via 777 permissions (see infrastructure role docs)
+
+# Volume mounts
+# Application files (world-readable for Caddy to serve static assets)
+Volume={{ nextcloud_html_dir }}:/var/www/html:Z
+
+# User data (private - only container can access)
+Volume={{ nextcloud_data_dir }}:/var/www/html/data:Z
+
+# Configuration (private - contains secrets)
+Volume={{ nextcloud_config_dir }}:/var/www/html/config:Z
+
+# Custom apps (world-readable)
+Volume={{ nextcloud_custom_apps_dir }}:/var/www/html/custom_apps:Z
+
+# Redis session configuration override (zz- prefix ensures it loads last)
+Volume={{ nextcloud_home }}/redis-session-override.ini:/usr/local/etc/php/conf.d/zz-redis-session-override.ini:Z,ro
+
+# Infrastructure sockets (mounted with world-readable permissions on host)
+Volume={{ postgresql_unix_socket_directories }}:{{ postgresql_unix_socket_directories }}:Z
+Volume={{ valkey_unix_socket_path | dirname }}:{{ valkey_unix_socket_path | dirname }}:Z
+
+# Expose FPM port to localhost only (Caddy will reverse proxy)
+PublishPort=127.0.0.1:{{ nextcloud_fpm_port }}:9000
+
+[Service]
+Restart=always
+TimeoutStartSec=300
+
+[Install]
+WantedBy=multi-user.target