feat(debyltech-cloud): lock customers to read-only, no discovery

Customers are admin-created accounts in per-customer groups. They should
read what staff share with them and nothing else. Checked against a test
customer in the UI, and by running the sharee and contacts-menu search
services as that user.

- shareapi_exclude_groups=allow, list [admin]: only staff can share. Exclude
  mode ("yes") only disables sharing for users whose groups are ALL
  excluded, so it never catches a customer in their own group.
- User/group autocomplete off. By default a customer typing "bas" found the
  owner's account. Staff share by exact group name; LibreSign signers are
  found by email.
- New shares default to View only (shareapi_default_permissions=1).
- files default_quota 0 B, so customers get no personal storage. Staff in
  cloud_debyltech_staff_users are exempted (skipped if not yet created).
- No "Leon Green" sample contact in new address books.
- The verify script fails the deploy if any isolation setting drifts.
- README: staff and customer onboarding checklist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/podman/defaults/main.yml

@@ -241,6 +241,14 @@ libresign_debyltech_cert_l: Newbury
 # cloud_debyltech_smtp_user / cloud_debyltech_smtp_pass in the vault.
 cloud_debyltech_smtp_host: email-smtp.us-east-1.amazonaws.com
 cloud_debyltech_smtp_port: 465
+# Staff vs customers (see "customer isolation" in containers/debyltech/cloud.yml).
+# Only this group may share; everyone else -- customers -- can only read what
+# is shared with them. Staff accounts are exempted from the 0 B default quota.
+# Accounts listed here that do not exist yet are skipped, not created.
+cloud_debyltech_staff_group: admin
+cloud_debyltech_staff_users:
+  - admin
+  - bastian@debyltech.com
 
 
 # Legacy nginx/ModSecurity configuration removed - Caddy provides built-in security