Expose generic Compose extension and devcontainer contract

[vitormattos]

Summary

Expose a generic Compose extension contract so external app repositories and devcontainers can reuse the NCDD runtime without introducing an app-specific lifecycle.

Changes

• keep dev-worker responsible only for runtime dimensions, isolation, lifecycle and URLs;
• replace APP_ID, APP_SOURCE_DIR, persisted app bindings and setup hooks with a generic NCDD_COMPOSE_OVERRIDE;
• allow a consumer override to mount zero, one or many apps and add project-specific services;
• keep the existing volumes/nextcloud/apps-extra workflow fully supported and remove the legacy/deprecation framing;
• move worker tests out of proxy-tests.yml into a dedicated worker-tests.yml;
• remove concrete PHP-series references from worker CI;
• add a generic image-build helper that resolves the configured PHP image/Dockerfile from the Compose runtime;
• make the PDO SQLite contract test discover all .docker/Dockerfile.php* files instead of enumerating versions;
• add a regression test that rejects concrete PHP-series references in the worker workflow;
• add an integration scenario with two external app checkouts mounted into the same worker;
• document Compose extensions and devcontainer usage without naming a primary application.

Design boundary

NCDD owns the Nextcloud runtime: PHP, databases, proxy, mail, Redis, worker state and lifecycle.

Consumer repositories own their source layout, application dependencies, setup commands and any project-specific services. A Compose override extends the canonical runtime instead of creating another setup path.

This means NCDD does not need to know which application is being developed and does not restrict a worker to a single app.

Validation

• worker contract tests pass;
• proxy unit tests pass;
• shellcheck passes;
• Docker integration workflows are running against the rewritten contract;
• commit 546853e819da58e1b9043171d161cbb21b17a7c4 is OpenPGP verified and DCO matches the author.

Closes #143