nextcloud: expose PVE NFS roots + /anca-elements via Files External

Mounts the Proxmox host NFS exports (/srv/nfs and /srv/nfs-ssd) into
the NC pod and surfaces them through occ files_external:create:

- /PVE NFS Pool      → /mnt/pve-nfs       (admin group only)
- /PVE NFS-SSD Pool  → /mnt/pve-nfs-ssd   (admin group only)
- /anca-elements     → /mnt/pve-nfs/anca-elements  (admin, anca users)

Mount visibility is controlled by occ files_external:applicable; no
Files Access Control. ACL state is reconciled idempotently by a
bootstrap Job that diffs desired vs current applicable_users /
applicable_groups (via files_external:list --output=json).

Bootstrap fixes vs initial design:
- Sync loop used `[ -n "$U" ] && cmd` which returns 1 on empty input,
  triggering set -e on no-op re-runs. Switched to process substitution
  `< <(jq ...)` so empty diff -> loop body never runs -> 0 exit.
- RBAC missed `watch` verb (kubectl wait spammed reflector errors).
- Manifest used display-name "viktor" instead of NC username "admin"
  for the /anca-elements applicable list.

Chart values: added two PV-backed volume mounts at /mnt/pve-nfs[+ssd]
and pinned securityContext to fsGroup=33 with fsGroupChangePolicy:
OnRootMismatch (chart default Always would recurse 600k+ files on
every pod restart).

stacks/nextcloud/chart_values.yaml

@@ -73,12 +73,22 @@ nextcloud:
       configMap:
         name: nextcloud-db-password-sync
         defaultMode: 0755
+    - name: pve-nfs
+      persistentVolumeClaim:
+        claimName: nextcloud-pve-nfs-root
+    - name: pve-nfs-ssd
+      persistentVolumeClaim:
+        claimName: nextcloud-pve-nfs-ssd-root
   extraVolumeMounts:
     - name: apache-tuning
       mountPath: /etc/apache2/mods-available/mpm_prefork.conf
       subPath: mpm_prefork.conf
     - name: db-password-sync
       mountPath: /docker-entrypoint-hooks.d/before-starting
+    - name: pve-nfs
+      mountPath: /mnt/pve-nfs
+    - name: pve-nfs-ssd
+      mountPath: /mnt/pve-nfs-ssd
 
 internalDatabase:
   enabled: false
@@ -134,6 +144,15 @@ podAnnotations:
   dependency.kyverno.io/wait-for: "mysql.dbaas:3306,redis-master.redis:6379"
   secret.reloader.stakater.com/reload: "nextcloud-db-creds"
 
+# OnRootMismatch: kubelet only recursively chowns the volume to fsGroup if the
+# root dir's GID doesn't already match. Without this, every pod restart triggers
+# a ~30-min recursive chown of /srv/nfs and /srv/nfs-ssd (600k+ files) — the
+# default policy "Always" recurses every time. Locks fsGroup=33 explicitly so
+# this block fully replaces the chart's default {fsGroup: 33}.
+securityContext:
+  fsGroup: 33
+  fsGroupChangePolicy: OnRootMismatch
+
 collabora:
   enabled: false # Using onlyoffice instead