backup: stop offsite-copying regenerable data; shrink nextcloud backup; pin nextcloud image

The offsite Synology hit 97% — the Backup share grew +670G in a week, traced
to the 2026-05-26 change that began mirroring large regenerable services
offsite, plus an unbounded nextcloud.log bloating its backups to 87G.

- nfs-mirror: re-exclude ollama, prometheus-backup, audiblez, ebook2audiobook
  (regenerable; live-only on sdc). Keep *-backup DB dumps (real safety copies).
- offsite-sync Step 2: nfs-ssd leg is now immich-only; ollama/llamacpp on the
  SSD no longer ship offsite (re-pullable models).
- daily-backup: skip nextcloud/nextcloud-data-proxmox (orphaned pre-encryption
  PV, still backed up weekly).
- nextcloud: cap+rotate the log (log_rotate_size=10MB); the dedicated backup
  now excludes html/ (app code, from image), logs, and preview cache and keeps
  only the latest copy (pvc-data holds version history) → <5G (was 87G).
- nextcloud: pin image to 32.0.9 in chart_values. A 2026-05-26 Keel bump moved
  the live pod to 32.0.9 (data migrated to 32.0.9.2) but TF still defaulted to
  32.0.3; reconciling that drift this session rolled a 32.0.3 pod that
  CrashLooped on the downgrade. Pinning eliminates the drift.

Docs: backup-dr.md + infra CLAUDE.md updated (add nfs-mirror, new exclusions).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

stacks/nextcloud/chart_values.yaml

@@ -1,3 +1,14 @@
+# Pin the image to 32.0.9 (apache). On 2026-05-26 Keel bumped the live
+# Deployment 32.0.3 → 32.0.9-apache and the DATA migrated to 32.0.9.2; Keel
+# was then disabled but chart_values was never pinned, so it kept defaulting
+# to the chart's appVersion (32.0.3). A 2026-06-01 `terragrunt apply`
+# reconciled that drift, rolled a 32.0.3 pod, and Nextcloud refused to
+# downgrade (data 32.0.9.2 > image 32.0.3.2) → CrashLoopBackOff. Pinning here
+# keeps TF the source of truth and matches the on-disk data version.
+image:
+  flavor: apache
+  tag: "32.0.9"
+
 nextcloud:
   host: nextcloud.viktorbarzin.me
   trustedDomains:
@@ -51,6 +62,10 @@ nextcloud:
       <?php
       $CONFIG = array(
         'loglevel' => 2,
+        // Cap + rotate nextcloud.log. Without this it grew unbounded to
+        // 10GB+ and bloated every backup (2026-06-01 space incident).
+        // At 10MB the log rotates to nextcloud.log.1 (1 kept) → ~20MB max.
+        'log_rotate_size' => 10485760,
         'mail_smtpdebug' => false,
       );
     zzz-mysql.config.php: |