Fix Nextcloud DNS resolution and implement systemd cron for background jobs

- Enable IP forwarding in security playbook (net.ipv4.ip_forward = 1)
- Add podman network firewall rules to fix container DNS/HTTPS access
- Implement systemd timer for reliable Nextcloud background job execution
- Add database optimization tasks (indices, bigint conversion, mimetypes)
- Configure maintenance window (04:00 UTC) and phone region (NO)
- Add security headers (X-Robots-Tag, X-Permitted-Cross-Domain-Policies)
- Create Nextcloud removal playbook for clean uninstall
- Fix nftables interface matching (podman0 vs podman+)

Root cause: nftables FORWARD chain blocked container egress traffic
Solution: Explicit firewall rules for podman0 bridge interface

roles/nextcloud/templates/nextcloud.config.php.j2

@@ -0,0 +1,32 @@
+<?php
+/**
+ * Nextcloud Additional Configuration
+ * Rick-Infra - Nextcloud Role
+ * 
+ * This file provides additional configuration for Nextcloud
+ * that complements the main config.php file.
+ * 
+ * Applied via: php occ config:system:set
+ */
+
+$CONFIG = array(
+  /**
+   * Maintenance Window
+   * 
+   * Defines a maintenance window during which resource-intensive
+   * operations (like database updates) can be performed.
+   * 
+   * Format: Hour (0-23, UTC)
+   */
+  'maintenance_window_start' => {{ nextcloud_maintenance_window_start }},
+
+  /**
+   * Default Phone Region
+   * 
+   * Sets the default country code for phone number validation.
+   * Used when users enter phone numbers without country prefix.
+   * 
+   * Format: ISO 3166-1 alpha-2 country code
+   */
+  'default_phone_region' => '{{ nextcloud_default_phone_region }}',
+);