feat(nextcloud): add Nextcloud-compatible API layer

Implement a complete Nextcloud client compatibility layer so that
Nextcloud desktop/mobile sync clients can connect to OxiCloud.

Key additions:
- Login Flow v2 (device auth) with OIDC bridge support
- WebDAV handler compatible with Nextcloud clients (PROPFIND, GET,
  PUT, DELETE, MKCOL, MOVE, COPY, HEAD, PROPPATCH)
- OCS API endpoints (user info, capabilities, notifications stubs,
  sharees, unified search)
- Basic Auth middleware with app password verification, account
  lockout integration, and blake3-keyed auth cache
- App password management: create, list, revoke via both native
  API (JWT-authenticated profile page) and Nextcloud OCS endpoints
- Nextcloud file ID mapping (oc:fileid) with persistent DB storage
- Chunked upload support (Nextcloud v2 chunking protocol)
- Trashbin WebDAV interface
- Avatar (SVG placeholder) and preview (redirect) handlers
- User profile page with app password management UI
- URL user validation on all DAV routes (403 on mismatch)
- Database schema for app_passwords and nextcloud_object_ids tables

All services are behind a `nextcloud.enabled` config flag and
cleanly separated under src/interfaces/nextcloud/.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

static/profile.html

@@ -94,6 +94,52 @@
       </div>
     </div>
 
+    <div class="profile-card" id="app-passwords-section">
+      <h2><i class="fas fa-key"></i> App Passwords</h2>
+      <p class="app-pw-desc">Generate passwords for WebDAV, CalDAV, and CardDAV clients. Each password is shown only once.</p>
+
+      <div class="app-pw-create">
+        <input type="text" id="app-pw-label" placeholder="Label (e.g. Thunderbird, macOS)" maxlength="128">
+        <button class="btn btn-primary" id="app-pw-generate" onclick="createAppPassword()"><i class="fas fa-plus"></i> Generate</button>
+      </div>
+
+      <div id="app-pw-created" class="app-pw-created" style="display:none">
+        <div class="app-pw-created-label">New password for <strong id="app-pw-created-label"></strong>:</div>
+        <div class="app-pw-created-value">
+          <code id="app-pw-created-password"></code>
+          <button class="btn btn-copy" onclick="copyAppPassword()" title="Copy to clipboard"><i class="fas fa-copy"></i></button>
+        </div>
+        <small>Copy this password now. You won't be able to see it again.</small>
+      </div>
+
+      <div id="app-pw-status"></div>
+
+      <table class="app-pw-table" id="app-pw-table">
+        <thead>
+          <tr><th>Label</th><th>Created</th><th>Last Used</th><th></th></tr>
+        </thead>
+        <tbody id="app-pw-tbody"></tbody>
+      </table>
+      <div id="app-pw-empty" class="app-pw-empty" style="display:none">No app passwords yet.</div>
+
+      <div id="app-pw-auto-section" class="app-pw-auto-section" style="display:none">
+        <button class="app-pw-auto-toggle" id="app-pw-auto-toggle" onclick="toggleAutoPasswords()">
+          <i class="fas fa-chevron-right" id="app-pw-auto-chevron"></i>
+          <span>Client sessions</span>
+          <span class="app-pw-auto-count" id="app-pw-auto-count">0</span>
+        </button>
+        <div id="app-pw-auto-body" style="display:none">
+          <p class="app-pw-auto-desc">Auto-generated when you connect a Nextcloud-compatible client.</p>
+          <table class="app-pw-table" id="app-pw-auto-table">
+            <thead>
+              <tr><th>Client</th><th>Created</th><th>Last Used</th><th></th></tr>
+            </thead>
+            <tbody id="app-pw-auto-tbody"></tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+
     <div class="profile-card" id="password-section">
       <h2><i class="fas fa-key"></i> Change Password</h2>
       <form id="password-form">