feat(debyltech-cloud): limit customers to Files, Activity and signing

Nothing was group-restricted, so customers saw Dashboard, Photos, Office
and the rest, plus Nextcloud's first-run and promo apps.

- Disable for everyone: firstrunwizard, recommendations, related_resources,
  weather_status, survey_client, support, app_api, contactsinteraction,
  photos. A refused disable now fails the play (occ exits 0 on "can't be
  disabled").
- Restrict dashboard and office to staff. defaultapp=dashboard,files so
  staff land on the dashboard and customers fall through to Files.
- libresign groups_request_sign pinned to staff and asserted in verify.
  LibreSign itself is deliberately NOT group-restricted: that also blocks
  anonymous requests and would break public signing links.
- profile.enabled=false; lookup_server="" (lookup_server_connector
  can't be disabled).
- README: what customers can open.

Checked as a probe customer: apps=files,activity,libresign,text,viewer,
lands in Files, can't request signatures; staff land on Dashboard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/podman/README.md

@@ -183,8 +183,16 @@ What a customer gets:
 - no view of other accounts or groups: the share search and contacts menu
   return nothing
 
+What they can open: Files, Activity, and LibreSign for signing only.
+Dashboard and Office are staff-only. Promotional or directory-style apps
+(first-run wizard, recommendations, weather, Photos, contacts interaction,
+lookup server, ...) are disabled for everyone. Only staff can *request*
+signatures.
+
 Signature requests to customers need no account: use LibreSign with their
-email address.
+email address. LibreSign stays enabled for all accounts on purpose.
+Restricting an app to a group also blocks visitors who aren't logged in,
+which would break the public signing links.
 
 ## Logging