stacks: add nextcloud Dockerfiles, fix a broken kodi compose edit

Adds the two Dockerfiles nextcloud's compose build: contexts were
already referencing but never had (custom smbclient support for the
main container, a documentserver base for euro-office) - both had
their real internal-CA-trust mechanism replaced with a comment
explaining what's there and why, per the standing rule against
publishing that detail.

Also fixes a compose bug: kodi-ma-bridge's `environment:` key had
been dropped, leaving KEY=value pairs nested under `env_file:` (which
expects file paths, not inline vars) - would have made docker-compose
try to open a file literally named `TZ=${TZ}`.

Rest of this commit is manual cleanup (comment tidying, dropped
personal media-library volume mounts, a couple of .env comment
trims).

stacks/platform/gitea/.env

@@ -7,8 +7,6 @@ TZ=Etc/UTC
 HTTP_PORT=3000
 SSH_PORT=22
 
-# Postgres (shared creds, separate DBs/instances)
-# POSTGRES_PASSWORD — see .env.secrets (Vault)
 POSTGRES_USER=gitea
 POSTGRES_DB=gitea
 

stacks/platform/grafana-stack/.env

@@ -8,7 +8,5 @@ HTTP_PORT_grafana=3693
 HTTP_PORT_loki=3100
 
 GF_AUTH_GENERIC_OAUTH_CLIENT_ID=example-oauth-client-id
-# GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET — see .env.secrets (Vault)
 AUTHENTIK_URL=https://authentik.caddy.example.com
 GRAFANA_URL=https://grafana.local.example.com
-# GRAFANA_ADMIN_PASSWORD — see .env.secrets (Vault)

stacks/platform/kestra/.env

@@ -4,7 +4,5 @@ HTTP_PORT=8080
 # Basic-auth login
 USERNAME=[email protected]
 
-# Postgres Creds
-# POSTGRES_PASSWORD — see .env.secrets (Vault)
 POSTGRES_USER=kestra
 POSTGRES_DB=kestra