Fix Nextcloud DNS resolution and implement systemd cron for background jobs

- Enable IP forwarding in security playbook (net.ipv4.ip_forward = 1)
- Add podman network firewall rules to fix container DNS/HTTPS access
- Implement systemd timer for reliable Nextcloud background job execution
- Add database optimization tasks (indices, bigint conversion, mimetypes)
- Configure maintenance window (04:00 UTC) and phone region (NO)
- Add security headers (X-Robots-Tag, X-Permitted-Cross-Domain-Policies)
- Create Nextcloud removal playbook for clean uninstall
- Fix nftables interface matching (podman0 vs podman+)

Root cause: nftables FORWARD chain blocked container egress traffic
Solution: Explicit firewall rules for podman0 bridge interface

playbooks/security.yml

@@ -322,8 +322,8 @@
         sysctl_file: /etc/sysctl.d/99-security.conf
         reload: yes
       loop:
-        # Disable IP forwarding
-        - { name: 'net.ipv4.ip_forward', value: '0' }
+        # Enable IP forwarding (required for container networking)
+        - { name: 'net.ipv4.ip_forward', value: '1' }
         - { name: 'net.ipv6.conf.all.forwarding', value: '0' }
         
         # Disable source routing