Fix Nextcloud Talk Recording volumes and fully enable external DB/Redis integration for ONLYOFFICE.

Includes:
- Talk recording tmp volume wiring for Nextcloud
- ONLYOFFICE external PostgreSQL/Redis env integration
- Added explicit volumes for pgdata/redis/rabbitmq
- Switched ONLYOFFICE role to sys-stk-full-stateful
- Updated docker-compose mounts and vars
- CSP and feature flag improvements

Conversation reference: https://chatgpt.com/share/6922f50e-cc44-800f-89fc-e1251c5bbe45

roles/web-app-nextcloud/templates/docker-compose.yml.j2

@@ -129,9 +129,10 @@
     networks:
       default:
         ipv4_address: 192.168.102.72
+    volumes:
+      - talk_recording_tmp:/tmp
 {% endif %}
 
-
 {% include 'roles/docker-compose/templates/volumes.yml.j2' %}
   data:
     name: {{ NEXTCLOUD_VOLUME }}
@@ -141,5 +142,9 @@
   whiteboard_fontcache:
     name: {{ NEXTCLOUD_WHITEBOARD_FRONTCACHE_VOLUME }}
 {% endif %}
+{% if NEXTCLOUD_RECORDING_ENABLED | bool %}
+  talk_recording_tmp:
+    name: {{ NEXTCLOUD_RECORDING_TMP_VOLUME }}
+{% endif %}
 
 {% include 'roles/docker-compose/templates/networks.yml.j2' %}

roles/web-app-nextcloud/templates/env.j2

@@ -62,7 +62,6 @@ STORAGE_STRATEGY=redis
 REDIS_URL=redis://redis:6379/0
 # Chromium (headless) hardening for Whiteboard
 CHROMIUM_FLAGS=--headless=new --no-sandbox --disable-gpu --disable-dev-shm-usage --use-gl=swiftshader --disable-software-rasterizer
-# Falls das Image Chromium mitbringt – Pfad meistens /usr/bin/chromium oder /usr/bin/chromium-browser:
 PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
 PUPPETEER_SKIP_DOWNLOAD=true
 {% endif %}