add trusted proxy, post-install/upgrade hooks, occ docs and admin review

- Add TRUSTED_PROXIES=caddy to fix reverse proxy header warning
- Add post-installation hook: maintenance window, phone region, DB indices, MIME migrations
- Add post-upgrade hook: DB indices and MIME migrations
- Add occ commands section to README
- Add nextcloud-review.md with admin warning fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -180,6 +180,22 @@ docker compose --env-file .env -f nextcloud/docker-compose.yml up -d
 docker compose --env-file .env -f gitea/docker-compose.yml logs -f
 ```
 
+## Running Nextcloud OCC Commands
+
+Nextcloud's `occ` command-line tool must run as the `www-data` user inside the container:
+
+```bash
+# General syntax
+sudo docker exec -u www-data nextcloud php occ <command>
+
+# Examples
+sudo docker exec -u www-data nextcloud php occ status
+sudo docker exec -u www-data nextcloud php occ config:list
+sudo docker exec -u www-data nextcloud php occ app:list
+sudo docker exec -u www-data nextcloud php occ db:add-missing-indices
+sudo docker exec -u www-data nextcloud php occ maintenance:repair --include-expensive
+```
+
 ## Adding a New Service
 
 1. Create a new directory: `mkdir myapp/`