Fix Nextcloud DNS resolution and implement systemd cron for background jobs

- Enable IP forwarding in security playbook (net.ipv4.ip_forward = 1)
- Add podman network firewall rules to fix container DNS/HTTPS access
- Implement systemd timer for reliable Nextcloud background job execution
- Add database optimization tasks (indices, bigint conversion, mimetypes)
- Configure maintenance window (04:00 UTC) and phone region (NO)
- Add security headers (X-Robots-Tag, X-Permitted-Cross-Domain-Policies)
- Create Nextcloud removal playbook for clean uninstall
- Fix nftables interface matching (podman0 vs podman+)

Root cause: nftables FORWARD chain blocked container egress traffic
Solution: Explicit firewall rules for podman0 bridge interface

rick-infra.yml

@@ -25,13 +25,13 @@
     #     name: authentik
     #   tags: ['authentik', 'sso', 'auth']
 
-    - name: Deploy Gitea
-      include_role:
-        name: gitea
-      tags: ['gitea', 'git', 'development']
-
-    # - name: Deploy Nextcloud
+    # - name: Deploy Gitea
     #   include_role:
-    #     name: nextcloud
-    #   tags: ['nextcloud', 'cloud', 'storage']
+    #     name: gitea
+    #   tags: ['gitea', 'git', 'development']
+
+    - name: Deploy Nextcloud
+      include_role:
+        name: nextcloud
+      tags: ['nextcloud', 'cloud', 'storage']