feat(debyltech-cloud): add cloud.debyltech.com Nextcloud

A de Byl Technologies LLC Nextcloud cloned from the Skudak instance:
LibreSign signing for people without an account, registration off
(admin-created accounts only), no Group Folders. DNS is a terraform-managed
ALIAS to fulfillr.debyltech.com.

- containers/debyltech/cloud.yml: nextcloud/mariadb/redis on port 8091.
  It installs unattended on the first deploy, sends mail through SES as
  noreply@debyltech.com, and re-asserts the Skudak LibreSign settings.
- files/debyltechmail: skudakmail rebranded, with a new black-and-white
  wordmark and white web-UI logos.
- LibreSign is pinned to 14.2.2 from the GitHub release (sha256-checked)
  rather than `occ app:install`. The app store served a same-day 14.2.3
  whose tarball has no binary-signature metadata. 14.2.x also doesn't
  create its own download dirs, so they're pre-created.
- The backup runs nightly at 04:15 to TrueNAS /mnt/glacier/debyltechcloud and
  reaches personal iDrive via the "iDrive E2 Backup" task; the TrueNAS side
  excludes /debyltechcloud/_backup/config/**.
- Fix the libresign:configure:check gate in both instances: '\berror\b'
  becomes a backspace in Jinja and never matched, so a check reporting three
  errors passed clean. Now '\\berror\\b'.
- vault: cloud_debyltech_* secrets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/podman/files/debyltechmail/lib/AppInfo/Application.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\Debyltechmail\AppInfo;
+
+use OCA\Debyltechmail\Listener\DebyltechMailListener;
+use OCA\Debyltechmail\Listener\DebyltechStyleListener;
+use OCP\AppFramework\App;
+use OCP\AppFramework\Bootstrap\IBootContext;
+use OCP\AppFramework\Bootstrap\IBootstrap;
+use OCP\AppFramework\Bootstrap\IRegistrationContext;
+use OCP\AppFramework\Http\Events\BeforeTemplateRenderedEvent;
+use OCP\Mail\Events\BeforeMessageSent;
+
+class Application extends App implements IBootstrap {
+	public const APP_ID = 'debyltechmail';
+
+	public function __construct(array $urlParams = []) {
+		parent::__construct(self::APP_ID, $urlParams);
+	}
+
+	public function register(IRegistrationContext $context): void {
+		// BeforeMessageSent fires in Mailer::send() (lib/private/Mail/Mailer.php:186),
+		// AFTER useTemplate() has flattened the template into subject/plain/html on
+		// the message, and BEFORE setRecipients() and the Symfony transport. That
+		// window is the only place an inline (cid:) logo can be attached -- see the
+		// listener for why the template class alone cannot do it.
+		$context->registerEventListener(BeforeMessageSent::class, DebyltechMailListener::class);
+
+		// BeforeTemplateRenderedEvent is dispatched from
+		// lib/private/AppFramework/Middleware/AdditionalScriptsMiddleware.php:35 and
+		// lib/private/Template/TemplateManager.php:82 -- the latter covers public
+		// (unauthenticated) pages, which is the case that matters here since the
+		// LibreSign signing page is a #[PublicPage].
+		$context->registerEventListener(BeforeTemplateRenderedEvent::class, DebyltechStyleListener::class);
+	}
+
+	public function boot(IBootContext $context): void {
+	}
+}