feat(nextcloud): integrate Talk & Whiteboard; refactor to NEXTCLOUD_* vars; full-stack setup

config(ports): add Nextcloud websocket port (4003); canonical domains (nextcloud/talk/whiteboard)

refactor: unify get_app_conf usage & Jinja spacing; migrate paths/handlers to new NEXTCLOUD_* vars

feat(plugins): split plugin routines; configure Whiteboard via occ (URL + JWT)

fix(oidc): use NEXTCLOUD_URL for logout; correct LDAP attribute mappings; add OIDC flavor switch

feat: Whiteboard container & reverse-proxy location; Talk STUN/WS ports; Redis URL for Whiteboard

chore: drop obsolete TODO; minor cleanups in oauth2-proxy, matrix, peertube, pgadmin, phpldapadmin, pixelfed, phpmyadmin

security(schema): Bluesky jwt_secret now base64_prefixed_32; add Nextcloud whiteboard_jwt_secret

db: normalize postgres image tag templating; central DB host checks spacing fixes

ops: add full-stack bootstrap (certs, proxy, volumes); internal nginx config reload handler update

refs: https://chatgpt.com/share/68b5f5b7-8d64-800f-b001-1241f818dc0e

roles/web-app-nextcloud/tasks/05_system_config.yml

@@ -0,0 +1,22 @@
+- name: Load System Nextcloud configuration variables
+  include_vars:
+    file: system.yml
+
+- name: "Apply Nextcloud system configs (batched shell)"
+  ansible.builtin.shell: |
+    set -euo pipefail
+    {% for item in nextcloud_system_config %}
+    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} \
+      config:system:set {{ item.parameter }}{% if item.type is defined %} --type {{ item.type }}{% endif %} \
+      --value '{{ (item.value | string) | regex_replace("'", "'" ~ '"' ~ "'" ~ '"' ~ "'") }}'
+    {% endfor %}
+  args:
+    executable: /bin/bash
+  register: syscfg_shell
+  changed_when: >
+    not ASYNC_ENABLED and
+    ( ((syscfg_shell.stdout | default('')) ~ (syscfg_shell.stderr | default(''))) 
+      is search(' set to ') )
+  failed_when: not ASYNC_ENABLED and syscfg_shell.rc != 0
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"