feat(nextcloud): integrate Talk & Whiteboard; refactor to NEXTCLOUD_* vars; full-stack setup

config(ports): add Nextcloud websocket port (4003); canonical domains (nextcloud/talk/whiteboard)

refactor: unify get_app_conf usage & Jinja spacing; migrate paths/handlers to new NEXTCLOUD_* vars

feat(plugins): split plugin routines; configure Whiteboard via occ (URL + JWT)

fix(oidc): use NEXTCLOUD_URL for logout; correct LDAP attribute mappings; add OIDC flavor switch

feat: Whiteboard container & reverse-proxy location; Talk STUN/WS ports; Redis URL for Whiteboard

chore: drop obsolete TODO; minor cleanups in oauth2-proxy, matrix, peertube, pgadmin, phpldapadmin, pixelfed, phpmyadmin

security(schema): Bluesky jwt_secret now base64_prefixed_32; add Nextcloud whiteboard_jwt_secret

db: normalize postgres image tag templating; central DB host checks spacing fixes

ops: add full-stack bootstrap (certs, proxy, volumes); internal nginx config reload handler update

refs: https://chatgpt.com/share/68b5f5b7-8d64-800f-b001-1241f818dc0e

roles/web-app-nextcloud/tasks/03_upgrade.yml

@@ -0,0 +1,37 @@
+- name: Nextcloud | Upgrade
+  command: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} upgrade"
+  register: occ_upgrade
+  changed_when: "'Already up to date' not in occ_upgrade.stdout"
+
+- name: Nextcloud | Maintenance repair
+  command: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} maintenance:repair --include-expensive"
+  register: occ_repair
+  changed_when: "'No repairs needed' not in occ_repair.stdout"
+
+- name: Nextcloud | App update (retry once)
+  command: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} app:update --all"
+  register: occ_app_update
+  changed_when: "'No apps found for update' not in occ_app_update.stdout"
+  retries: 2
+  delay: 3
+  until: occ_app_update.rc == 0
+
+- name: Nextcloud | Add missing columns
+  command: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} db:add-missing-columns"
+  register: occ_columns
+  changed_when: "'No columns found' not in occ_columns.stdout"
+
+- name: Nextcloud | Add missing indices
+  command: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} db:add-missing-indices"
+  register: occ_indices
+  changed_when: "'No indices found' not in occ_indices.stdout"
+
+- name: Nextcloud | Add missing primary keys
+  command: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} db:add-missing-primary-keys"
+  register: occ_pks
+  changed_when: "'No primary keys found' not in occ_pks.stdout"
+
+- name: Nextcloud | Disable maintenance mode
+  command: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} maintenance:mode --off"
+  register: occ_maint_off
+  changed_when: "'already disabled' not in occ_maint_off.stdout"