feat(nextcloud): give xwiki its own variant and loosen its bond

Variant 0 of this role no longer fits the box CI gives it. Job 94319317296 of
run 31658270172 started at 01:49:01Z and logged
"##[error]The operation was canceled." at 07:44:14Z -- 355 minutes later, to the
minute, which is the ceiling .github/workflows/call-test-deploy-swarm.yml:161
sets. It died inside its own step, at
"TASK [test-e2e-playwright : ▶️ Run Playwright container]". The drill costs about
6h40m and the box is 5h55m.

The cost is dominated by the deploy itself, not by a repeatable sweep: PASS 1
alone is 13695.90s in role-runtimes, of which sys-svc-compose is 3094.19s and
test-e2e-playwright 2832.15s. It therefore scales with how many services variant
0 switches on, which is what this commit reduces.

The file's own header states the rule: variant 0 carries every tightly-coupled
(bond>=1, same-host) service, while loosely-coupled (bond<1) partners are
excluded from the closure and distributed across later variants to keep each
host under budget. xwiki and bigbluebutton were declared bond: 1 and therefore
had to sit in variant 0. Both are bridged partners with their own role and their
own spec -- the same shape as openproject, gitlab and mattermost, which already
carry bond: 0.5 -- so the declaration was the outlier, not the placement.

Both bonds drop to 0.5. xwiki moves out of variant 0 into a new variant 8 with
sso, ldap and tor, the same shape as variant 5 (zammad) and variant 6 (gitlab).
bigbluebutton stays in variant 0 for now, by explicit request; its bond change
only makes the move possible later. Each edge is one-directional -- neither
web-app-xwiki nor web-app-bigbluebutton declares a nextcloud service -- so there
is exactly one bond per partner to change.

coturn is deliberately absent from variant 8. BigBlueButton speaks WebRTC and
the reflex is to bring a TURN server, but the only coupling in the repo is
meta/addons/spreed.yml:8, which bridges coturn for Nextcloud Talk, and talk is
off in that variant. An extra service there would be exactly the overhead this
commit removes.

Measured: the file loads to 9 variants, variant 0 falls from 16 enabled services
to 15, and variant 8 resolves to ['ldap', 'sso', 'tor', 'xwiki']. make test-lint
stays at 328 passed -- variant-limit (capped at 3, opened by the file's existing
nocheck), variants-static-override and the bond lint (which only requires a
number in 0..1) all accept it.

Not measured, and the honest cost: a ninth variant is one more deploy round, and
the limit lint's own rationale says total deploy time grows linearly with
max(variant_count) across the primary apps -- Nextcloud sets that maximum, so
this is roughly +12.5% for the whole matrix, spent to relieve the single job that
dies on its own ceiling. Whether removing one service of sixteen closes a ~45
minute overrun is not established; role-runtimes has the per-role seconds and no
run has been made with this shape.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-nextcloud/meta/services.yml

@@ -182,12 +182,12 @@ collabora:
   shared: "{{ 'web-svc-collabora' in group_names }}"
 # nocheck: playwright-service-flag: bridged web-conferencing partner, covered by partner role spec
 bigbluebutton:
-  bond: 1
+  bond: 0.5
   enabled: "{{ 'web-app-bigbluebutton' in group_names }}"
   shared: "{{ 'web-app-bigbluebutton' in group_names }}"
 # nocheck: playwright-service-flag: bridged wiki partner, covered by partner role spec
 xwiki:
-  bond: 1
+  bond: 0.5
   enabled: "{{ 'web-app-xwiki' in group_names }}"
   shared: "{{ 'web-app-xwiki' in group_names }}"
 # nocheck: playwright-service-flag: object store, no Playwright surface

roles/web-app-nextcloud/meta/variants.yml

@@ -56,8 +56,8 @@
       enabled: true
       shared: true
     xwiki:
-      enabled: true
-      shared: true
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
     seaweedfs:
       enabled: true
       shared: true
@@ -716,3 +716,91 @@
       shared: true
     tor:
       enabled: true
+# Variant 8: xwiki
+- services:
+    container_backup:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    sso:
+      enabled: true
+      shared: true
+    coturn:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    logout:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    ldap:
+      enabled: true
+      shared: true
+    dashboard:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    matomo:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    email:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    mariadb:
+      shared: true
+    redis:
+      shared: true
+    talk:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    talk_recording:
+      enabled: false
+    onlyoffice:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    collabora:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    bigbluebutton:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    xwiki:
+      enabled: true
+      shared: true
+    seaweedfs:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    css:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    prometheus:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    openproject:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    gitlab:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    discourse:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    mattermost:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    matrix:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    zammad:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    openwebui:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    flowise:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    mastodon:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    peertube:
+      enabled: false
+      shared: false # nocheck: variants-static-override backup shared stays literally true
+    tor:
+      enabled: true