feat(nextcloud): integrate Talk & Whiteboard; refactor to NEXTCLOUD_* vars; full-stack setup

config(ports): add Nextcloud websocket port (4003); canonical domains (nextcloud/talk/whiteboard)

refactor: unify get_app_conf usage & Jinja spacing; migrate paths/handlers to new NEXTCLOUD_* vars

feat(plugins): split plugin routines; configure Whiteboard via occ (URL + JWT)

fix(oidc): use NEXTCLOUD_URL for logout; correct LDAP attribute mappings; add OIDC flavor switch

feat: Whiteboard container & reverse-proxy location; Talk STUN/WS ports; Redis URL for Whiteboard

chore: drop obsolete TODO; minor cleanups in oauth2-proxy, matrix, peertube, pgadmin, phpldapadmin, pixelfed, phpmyadmin

security(schema): Bluesky jwt_secret now base64_prefixed_32; add Nextcloud whiteboard_jwt_secret

db: normalize postgres image tag templating; central DB host checks spacing fixes

ops: add full-stack bootstrap (certs, proxy, volumes); internal nginx config reload handler update

refs: https://chatgpt.com/share/68b5f5b7-8d64-800f-b001-1241f818dc0e

roles/web-app-nextcloud/tasks/_plugin_a_routines.yml

@@ -0,0 +1,46 @@
+- name: "Disable incompatible plugins for {{ plugin_key }} (batched shell, no async)"
+  ansible.builtin.shell: |
+    # do not set -e here; allow per-line fallbacks
+    {% for incompatible_plugin in (plugin_value.incompatible_plugins | default([])) %}
+    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} app:disable {{ incompatible_plugin }} || true
+    {% endfor %}
+  args:
+    executable: /bin/bash
+  when:
+    - plugin_value.incompatible_plugins is defined
+    - plugin_value.incompatible_plugins | length > 0
+  register: disable_incompat
+  changed_when: >
+    (((disable_incompat.stdout | default('')) ~ (disable_incompat.stderr | default('')))
+      is search('disabled'))
+    and (
+      (((disable_incompat.stdout | default('')) ~ (disable_incompat.stderr | default('')))
+        is not search('already disabled'))
+    )
+  failed_when: false
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
+
+- name: install {{ plugin_key }} nextcloud plugin
+  command: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} app:install {{ plugin_key }}"
+  register: install_result
+  failed_when: >
+    install_result.rc != 0
+    and
+    ("already installed" not in install_result.stdout)
+    and
+    ("not compatible with this version of the server" not in install_result.stdout)
+  changed_when: >
+    install_result.rc == 0
+    and
+    ("already installed" not in install_result.stdout)
+
+- include_tasks: _plugin_b_enable_and_configure.yml
+  when:
+    - install_result is defined 
+    - >
+      install_result.rc == 0
+      or "already installed" in install_result.stdout
+  vars:
+    plugin_task_path: "{{ NEXTCLOUD_CNODE_PLUGIN_TASKS_PATH }}{{ plugin_key }}.yml"
+    plugin_vars_path: "{{ NEXTCLOUD_CNODE_PLUGIN_VARS_PATH }}{{ plugin_key }}.yml"