feat(nextcloud): standalone Docker stack + split provisioner pattern (misp-style)

[t0kubetsu]

Summary

• Replaces the two-stage PHP builder Dockerfile and static users.yml with the misp-standalone provisioner pattern: Alpine single-stage image; bash/curl/jq/openssl toolchain; provisioning scripts volume-mounted at runtime (not baked in)
• Splits provisioning into three focused scripts: provision.sh (orchestrator) → provision-users.sh (OCS API user creation) → provision-tokens.sh (app-password generation)
• User set is now driven entirely by env vars (NC_TEAMS, NC_INSTRUCTOR_COUNT, NC_USERS_PER_TEAM) — no YAML file to maintain
• Passwords auto-generated on first run, written to /tokens/nc-credentials.json; idempotency stamp at /tokens/.provisioned prevents re-run on restart
• make keys target added to surface the full credentials JSON alongside the existing make tokens

Closes #146

Scope: 03_container_layer/docker/admin/nextcloud/ only.

Changed files

File	Change
Dockerfile	Two-stage PHP builder → Alpine single-stage provisioner
compose.yml	Provisioner section: env_file + three :ro script mounts
.env.example	Adds NC_TEAMS, NC_INSTRUCTOR_ORG, NC_INSTRUCTOR_COUNT, NC_USERS_PER_TEAM, NC_USER_DOMAIN
Makefile	Adds keys target
README.md	Documents env-driven user model and credential retrieval
provisioning/provision.sh	New: thin orchestrator entrypoint
provisioning/provision-users.sh	New: OCS API user + group creation
provisioning/provision-tokens.sh	New: app-password generation loop
provisioning/init.sh	Deleted
provisioning/users.yml	Deleted

Test plan

• make build-up builds provisioner image without errors
• make logs-provisioner shows users created + tokens written
• make tokens prints username:apppassword lines
• make keys prints nc-credentials.json with all users
• Re-running provisioner after stack restart exits with "Already provisioned"
• make reprovision triggers a fresh provisioning run

[t0kubetsu]

Deployment prerequisite — cp .env.example .env on the deployer

Before running the scenario, the stack directory on the deployer's catalog copy must have a .env file. The compose.yml declares env_file: .env for the provisioner service; Docker Compose treats this as required by default and returns empty stdout if the file is missing, causing community.docker.docker_compose_v2 to fail with:

Error while parsing JSON output … Expecting value: line 1 column 1 (char 0)

Workaround (until resolved at the catalog level):

cd /path/to/range42-catalog/03_container_layer/docker/admin/nextcloud
cp .env.example .env

All defaults in .env.example are suitable for lab use. Test plan is otherwise ✅ all green.