Add storage keepalive (upholds) across services, Nextcloud cron, disable Nextcloud PHP JIT

Requires= doesn't restart a service once its required mount comes back after
a USB disconnect/remount, so a dedicated storage-keepalive unit now Upholds=
every storage-dependent service to bring it back automatically. Also adds the
missing Nextcloud cron.php timer (background jobs were never triggered), and
disables opcache.jit in the Nextcloud container — PHP 8.4's JIT was
miscompiling OC\Config\UserConfig::getValueBool(), crashing every
session-bootstrapping request with a bogus strtolower() TypeError.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/pi-main/default.nix

@@ -222,6 +222,30 @@
     };
   };
 
+  # Nextcloud's "cron" backgroundjobs_mode (config:app:get core backgroundjobs_mode)
+  # doesn't schedule itself — something external must call cron.php periodically.
+  # Nothing did, so background jobs (including the News app's feed fetcher)
+  # went stale. Nextcloud recommends every 5 minutes.
+  systemd.services.nextcloud-cron = {
+    description = "Nextcloud background job runner (cron.php)";
+    after       = [ "podman-nextcloud.service" ];
+    requires    = [ "podman-nextcloud.service" ];
+    serviceConfig = {
+      Type      = "oneshot";
+      ExecStart = "${pkgs.podman}/bin/podman exec -u www-data nextcloud php -f cron.php";
+    };
+  };
+
+  systemd.timers.nextcloud-cron = {
+    description = "Run Nextcloud cron.php every 5 minutes";
+    wantedBy    = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec       = "5min";
+      OnUnitActiveSec = "5min";
+      Persistent      = true;
+    };
+  };
+
   # -------------------------------------------------------------------------
   # Local DNS overrides (optional — makes LAN clients hit the Pi directly
   # instead of going through Cloudflare for *.zakobar.com)