nextcloud: fix backup retention to sort by name, not mtime

The dated backup dirs are named YYYYMMDD_HHMMSS, but the cleanup used
`ls -dt` (mtime). `rsync -a` stamps the backup dir with the SOURCE dir's
mtime, so the freshest backup didn't sort as newest — the retention step
deleted the new backup and kept a stale one. Sort lexically (chronological
for these names) and keep the last.

Also exclude html/ (the app code, reproducible from the now-pinned image;
the real config lives at config/config.php, html/config is empty) so the
backup is config+data+custom_apps only → ~4.3G (<5G target).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

stacks/nextcloud/main.tf

@@ -404,9 +404,14 @@ resource "kubernetes_config_map" "backup-script" {
       # so this browsable app-level copy only needs the most recent. Keeping the
       # whole installation (incl. logs) x7 here was the bulk of the 87G that
       # filled the offsite Synology.
-      echo "Cleaning old backups..."
+      #
+      # Sort by NAME, not mtime: dirs are YYYYMMDD_HHMMSS so lexical order is
+      # chronological. `rsync -a` stamps the backup dir with the SOURCE dir's
+      # mtime, which made the old `ls -dt | tail` delete the freshest backup and
+      # keep a stale one — keep the lexically-last (newest) instead.
+      echo "Cleaning old backups (keep latest)..."
       cd "$BACKUP_DIR"
-      ls -dt */ | tail -n +2 | xargs -r rm -rf
+      ls -d */ 2>/dev/null | sort | head -n -1 | xargs -r rm -rf
 
       echo "Backup completed at $(date)"
       echo "Backup stored at: $BACKUP_PATH"