Fix Nextcloud DNS resolution and implement systemd cron for background jobs

- Enable IP forwarding in security playbook (net.ipv4.ip_forward = 1)
- Add podman network firewall rules to fix container DNS/HTTPS access
- Implement systemd timer for reliable Nextcloud background job execution
- Add database optimization tasks (indices, bigint conversion, mimetypes)
- Configure maintenance window (04:00 UTC) and phone region (NO)
- Add security headers (X-Robots-Tag, X-Permitted-Cross-Domain-Policies)
- Create Nextcloud removal playbook for clean uninstall
- Fix nftables interface matching (podman0 vs podman+)

Root cause: nftables FORWARD chain blocked container egress traffic
Solution: Explicit firewall rules for podman0 bridge interface

roles/nextcloud/templates/nextcloud.caddy.j2

@@ -58,6 +58,10 @@
         Referrer-Policy "no-referrer"
         # Disable FLoC tracking
         Permissions-Policy "interest-cohort=()"
+        # Robot indexing policy
+        X-Robots-Tag "noindex, nofollow"
+        # Cross-domain policy
+        X-Permitted-Cross-Domain-Policies "none"
         # Remove server header
         -Server
     }