Use one application workspace per worker

[vitormattos]

Summary

Replace the arbitrary downstream Compose extension with one optional application workspace per worker.

Each workspace is a directory containing whatever set of Nextcloud apps that worker needs. NCDD mounts the complete directory at /var/www/html/apps-extra and remains unaware of individual app ids, dependencies or repository layout.

This follows up #148 with the smaller contract discussed after merge.

Changes

• replace NCDD_COMPOSE_OVERRIDE with NCDD_WORKSPACE;
• add one internal .docker/workspace.yml owned by NCDD instead of accepting consumer-controlled Compose;
• mount the complete workspace into Nextcloud, nginx and Playwright;
• keep the existing volumes/nextcloud/apps-extra behavior when no workspace is provided;
• keep worker runtime state under .workers/<worker-id> and never delete the external workspace;
• test a workspace containing multiple apps rather than individual app mounts;
• remove the MariaDB-version-specific isolation branch from the matrix workflow;
• derive the MariaDB Compose service name from MARIADB_VERSION and validate it against .docker/database-services.yml instead of hardcoding a version-to-service mapping;
• update documentation around the worker workspace contract.

Design boundary

A worker represents one isolated Nextcloud development environment.

The caller decides what applications belong in that worker by preparing one directory. It may contain zero, one or dozens of apps, including clones or Git worktrees.

NCDD owns PHP, Nextcloud, databases, proxy, supporting services and disposable worker state. It does not model a primary app and does not expose its Compose topology as a downstream API.

Validation

Commit b7bc2c9f3ac48bb47c1875001c618d75791600b2 is OpenPGP verified and includes a matching DCO sign-off.