Fix Nextcloud DNS resolution and implement systemd cron for background jobs

- Enable IP forwarding in security playbook (net.ipv4.ip_forward = 1)
- Add podman network firewall rules to fix container DNS/HTTPS access
- Implement systemd timer for reliable Nextcloud background job execution
- Add database optimization tasks (indices, bigint conversion, mimetypes)
- Configure maintenance window (04:00 UTC) and phone region (NO)
- Add security headers (X-Robots-Tag, X-Permitted-Cross-Domain-Policies)
- Create Nextcloud removal playbook for clean uninstall
- Fix nftables interface matching (podman0 vs podman+)

Root cause: nftables FORWARD chain blocked container egress traffic
Solution: Explicit firewall rules for podman0 bridge interface

roles/podman/tasks/main.yml

@@ -42,6 +42,22 @@
     backup: yes
   notify: restart podman
 
+- name: Create default podman network with DNS enabled
+  command: podman network create podman --subnet 10.88.0.0/16
+  register: podman_network_create
+  changed_when: "'podman' in podman_network_create.stdout"
+  failed_when: 
+    - podman_network_create.rc != 0
+    - "'already exists' not in podman_network_create.stderr"
+
+- name: Deploy podman firewall rules
+  template:
+    src: podman.nft.j2
+    dest: /etc/nftables.d/10-podman.nft
+    mode: '0644'
+    backup: yes
+  notify: reload nftables
+
 - name: Enable podman system service (if enabled)
   systemd:
     name: podman