Fix nextcloud-pvc-sync: add fsGroup for data access, fix restic cache dir

Now that the endpoint/credentials are fixed and this job can actually
reach the VPS, it surfaced two more real bugs: no fsGroup (couldn't read
the PVC data at all - nextcloud's real Deployment uses fsGroup 33/www-data,
this job never matched it) and no writable cache dir for runAsUser 65534
(restic defaults to $HOME/.cache).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/nextcloud/manifests/pvc-sync-cronjob.yaml

@@ -63,6 +63,11 @@ spec:
           securityContext:
             runAsNonRoot: true
             runAsUser: 65534
+            # Matches the real nextcloud Deployment's fsGroup (33/www-data) -
+            # without it this job can't read the PVC data at all (confirmed
+            # live 2026-08-18: "permission denied" on every file/dir under
+            # /data once it could actually reach the VPS to back up to).
+            fsGroup: 33
             seccompProfile:
               type: RuntimeDefault
           affinity:
@@ -88,6 +93,10 @@ spec:
                   export RESTIC_PASSWORD_FILE=/restic-secret/password
                   export AWS_ACCESS_KEY_ID="${MINIO_ACCESS_KEY}"
                   export AWS_SECRET_ACCESS_KEY="${MINIO_SECRET_KEY}"
+                  # Default cache dir is $HOME/.cache - runAsUser 65534 has
+                  # no writable HOME, restic errors with "mkdir /.cache:
+                  # permission denied" otherwise.
+                  export RESTIC_CACHE_DIR=/tmp/restic-cache
 
                   restic snapshots >/dev/null 2>&1 || restic init