fix(debyltech-cloud): external signers, proxy trust, light-only mail

- Enable LibreSign's email identify method (click-to-sign, no account
  creation), remove the stamp background and collect signer metadata.
  On Skudak these were only ever set in the admin UI. Without the email
  method a fresh instance answers "No signers." for any outside address.
  The verify script now asserts it.
- Store add_footer=true explicitly. The code already defaults to it, but
  the 14.2 admin page shows unset as unchecked.
- trusted_proxies = the container's own address, read per deploy. Behind
  rootless port forwarding every request arrives from it, so without this
  X-Forwarded-For was ignored and every client shared one IP for
  brute-force throttling.
- maintenance_window_start and default_phone_region, which clears the setup
  warnings.
- Mail declares color-scheme "light only" so Apple Mail's dark mode doesn't
  repaint the white ground and bury the black wordmark (asserted in verify).
- Idempotency: redis image fully qualified (docker.io/library/...), the
  debyltechmail copy owned by the mapped www-data uid, and theming
  compared before setting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/podman/templates/nextcloud/debyltechmail-verify.php.j2

@@ -72,6 +72,10 @@ if (!str_contains($text, 'official document-signing request')) {
 if (!str_contains($html, 'debyltech.com/legal/privacy') || !str_contains($html, 'debyltech.com/legal/tos')) {
 	$failures[] = 'privacy/terms links missing from footer';
 }
+if (!str_contains($html, 'content="light only"')) {
+	$failures[] = 'color-scheme "light only" meta missing -- dark-mode mail clients will repaint '
+		. 'the ground and bury the black wordmark (did upstream rename </head> in $head?)';
+}
 if (preg_match('/[»«]/u', $html)) {
 	$failures[] = 'German guillemets survived into the body';
 }
@@ -131,6 +135,20 @@ if ($appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_
 		. 'unset or "yes"; it is NOT the knob for the account-owned-email problem.';
 }
 
+// Outside signers are invited by address; without an enabled email identify
+// method the signer search returns "No signers." for any non-account email.
+$methods = json_decode($appConfig->getValueString('libresign', 'identify_methods', '[]'), true) ?: [];
+$emailOn = false;
+foreach ($methods as $m) {
+	if (($m['name'] ?? '') === 'email' && !empty($m['enabled'])) {
+		$emailOn = true;
+	}
+}
+if (!$emailOn) {
+	$failures[] = 'libresign email identify method is not enabled -- outside addresses '
+		. 'cannot be added as signers ("No signers.")';
+}
+
 $identDocs = $appConfig->getValueString('libresign', 'identification_documents', '');
 if ($identDocs !== '0') {
 	$failures[] = 'libresign identification_documents is "' . $identDocs