Refactor devcontainer to reuse nextcloud-docker-development

[vitormattos]

Summary

Replace LibreSign's independent Dev Container infrastructure with a thin adapter over LibreCodeCoop/nextcloud-docker-development (NCDD).

Architecture

NCDD owns the generic development runtime:

• Nextcloud/PHP;
• database;
• nginx;
• Redis;
• Mailpit;
• shared HTTPS proxy;
• optional Playwright service;
• worker isolation and runtime state.

LibreSign owns only:

• the pinned NCDD revision it consumes;
• mounting the LibreSign checkout as /var/www/html/apps-extra/libresign;
• LibreSign-specific application setup;
• editor customizations.

Dev Container lifecycle

.devcontainer/prepare.sh is a small host-side adapter. It:

• fetches the pinned NCDD revision when necessary;
• derives a deterministic worker id from the checkout path;
• asks NCDD's public dev-worker config command to render the resolved Compose configuration;
• preserves the host UID/GID;
• supplies the Codespaces public hostname when running remotely.

.devcontainer/setup.sh contains only LibreSign-specific application bootstrap and runs as postCreateCommand.

Browser access

Local development uses NCDD's shared HTTPS proxy and the canonical
https://ncdev-<worker>.localhost hostname.

Codespaces uses the shared proxy's HTTPS port and configures Nextcloud with
the Codespaces forwarding hostname. The adapter avoids service-qualified
host:port forwarding because Codespaces does not support that form.
Mailpit remains reachable from the development environment and through NCDD
locally.

Regression coverage

The dedicated Devcontainer workflow has two layers:

• a fast contract job using ShellCheck, JSON validation and Bats;
• a full integration job using the reference Dev Container CLI.

The Bats suite covers local rendering, idempotency, supported overrides,
invalid Codespaces context and the Codespaces public URL. The integration job
runs the real devcontainer up lifecycle, executes the LibreSign
postCreateCommand, verifies Nextcloud/LibreSign/Mailpit, and verifies that
Playwright reaches Nextcloud through the canonical NCDD proxy URL.

Defaults

• PHP 8.3
• Nextcloud master
• MariaDB 10.6

These can be overridden through the documented LIBRESIGN_* environment variables.

Closes #8988