fix(web-app-opencloud): serve OpenCloud under one network only

OpenCloud answers under a single OC_URL and its web client takes the server from it, so on a multi row the onion sibling requested the clearnet origin (ocs capabilities, webfinger, app/list, theme.json); the onion vhost's CSP blocked them and the network-leak, SSO login and design specs of OpenCloud#0 failed on every onion pick (fork run 42305502796, job 128379005141). Upstream has no multi-origin support (opencloud-eu/opencloud#3468), so the role declares reachability.single_mode like web-app-matrix, as requirement 037 prescribes instead of a handover. On a node that serves Tor the role is now published on its onion address alone; the planner drops only OpenCloud's multi rows and keeps its clearnet and tor rows.

🎯 Fix: 92 %
💥 Break: 10 %
💸 Cost: –
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 83
🚦 Gate: ⛔ break 10 % > 5; committed and merged on the operator's word, the proof deploy and CI are the live proof

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/web-app-opencloud/README.md

@@ -6,7 +6,7 @@
 
 ## Overview
 
-This role deploys OpenCloud using Docker Compose in single-binary mode and exposes it under `open.cloud.{{ DOMAIN_PRIMARY }}` through the central reverse proxy. It wires the deployment to the shared Keycloak realm via OIDC, sources users and groups from the central `svc-db-openldap` directory, and runs side by side with `web-app-nextcloud` so both file platforms can coexist on the same host. For identity wiring details see [IAM.md](docs/IAM.md) and [LDAP.md](docs/LDAP.md).
+This role deploys OpenCloud using Docker Compose in single-binary mode and exposes it under `open.cloud.{{ DOMAIN_PRIMARY }}` through the central reverse proxy. OpenCloud answers under one origin only, so on a node that also serves Tor it is published on its onion address alone. It wires the deployment to the shared Keycloak realm via OIDC, sources users and groups from the central `svc-db-openldap` directory, and runs side by side with `web-app-nextcloud` so both file platforms can coexist on the same host. For identity wiring details see [IAM.md](docs/IAM.md) and [LDAP.md](docs/LDAP.md).
 
 ## Features
 

roles/web-app-opencloud/meta/networks.yml

@@ -2,3 +2,5 @@
 meshes: []
 local:
   subnet: 192.168.43.0/24
+reachability:
+  single_mode: true # nocheck: network-reachability  OC_URL is one origin and the web client takes its server from it, so an onion sibling requests the clearnet origin; upstream opencloud-eu/opencloud#3468