feat(debyltech-cloud): lock customers to read-only, no discovery

Customers are admin-created accounts in per-customer groups. They should
read what staff share with them and nothing else. Checked against a test
customer in the UI, and by running the sharee and contacts-menu search
services as that user.

- shareapi_exclude_groups=allow, list [admin]: only staff can share. Exclude
  mode ("yes") only disables sharing for users whose groups are ALL
  excluded, so it never catches a customer in their own group.
- User/group autocomplete off. By default a customer typing "bas" found the
  owner's account. Staff share by exact group name; LibreSign signers are
  found by email.
- New shares default to View only (shareapi_default_permissions=1).
- files default_quota 0 B, so customers get no personal storage. Staff in
  cloud_debyltech_staff_users are exempted (skipped if not yet created).
- No "Leon Green" sample contact in new address books.
- The verify script fails the deploy if any isolation setting drifts.
- README: staff and customer onboarding checklist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/podman/README.md

@@ -154,6 +154,38 @@ LibreSign setup failures and buys nothing at this scale.
   (LibreSign issue #4872).
 
 
+## cloud.debyltech.com accounts
+
+Registration is off, so every account is created by an admin in
+Settings → Accounts. The isolation policy in
+`tasks/containers/debyltech/cloud.yml` is enforced on every deploy and checked
+by the verify script.
+
+**Staff**: add to the `admin` group (the only group allowed to share) and to
+`cloud_debyltech_staff_users` in `defaults/main.yml`, so the next deploy
+exempts them from the 0 B default quota. Until then, set the account's quota
+to *Unlimited* by hand.
+
+**Customer**:
+1. Create a group per customer, e.g. `Customer - Acme`. Use a consistent
+   prefix: autocomplete is off, so you share by typing the **exact** group
+   name.
+2. Create the account with only their email filled in and no password, in
+   that group. Nextcloud sends a branded welcome email with a set-password
+   link.
+3. Share a folder (for example `Customers/Acme`) with the group. It defaults
+   to **View only**; choose *Allow editing* only if they should upload.
+
+What a customer gets:
+- read-only access to what's shared with them
+- no personal storage (0 B quota)
+- no sharing or public links
+- no view of other accounts or groups: the share search and contacts menu
+  return nothing
+
+Signature requests to customers need no account: use LibreSign with their
+email address.
+
 ## Logging
 
 Every container runs with `log_driver=journald`, so container stdout lands in