Two bugs found by Claude Code review:

1. systemd.mounts is typed as a list, not an attrset — the foldl' attrset
construct would fail at eval time. Even if fixed, declaring a mount
in systemd.mounts shadows the fileSystems-generated unit, but our
entry omitted what/type/options so the shadow would be broken.

Fix: use systemd.units."<name>.mount" with overrideStrategy =
"asDropin". This writes /etc/systemd/system/<unit>.d/override.conf
which merges into the fileSystems-generated unit cleanly.

2. Health check mountpoint -q doesn't detect stale FUSE mounts (kernel
retains the mountpoint even after rclone dies, returning ENOTCONN).

Fix: add a timeout 10 ls $path check. On stale mount, lazy-unmount
with umount -l before resetting and restarting the unit.

CI revealed that fileSystems."<path>".unitConfig doesn't exist in
the deployed NixOS version. The proper NixOS option is
systemd.mounts."<path>".unitConfig, which merges with the mounts
auto-generated from fileSystems entries.

Three layers of defense:

1. StartLimitIntervalSec=0 — removes systemd's permanent
failure state for rclone mount units so automount retries
indefinitely when network recovers (core fix)

2. systemd timer (every 5 min) — health checks each B2 mount
and resets + restarts any that have gone stale, catching
edge cases the automount retry doesn't cover

3. network-online.target ordering — health service respects
network state before attempting recovery

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

The nextcloud-local valkey HelmRelease reused releaseName 'valkey', which
collides with the shared default-ns valkey release in Flux's flux-system
Helm storage (both write sh.helm.release.v1.valkey.v*). Give it a unique
release name so the two stop overwriting each other's release secret and
flapping on reconcile. Chart resources stay named 'valkey' (Chart.Name),
so valkey.nextcloud.svc is unaffected.

Move the nextcloud HelmRelease to its own namespace with a dedicated
valkey (added previously), repoint REDIS_HOST to the local instance, and
re-target the SSO env secret via a per-client namespace override in the
OIDC bootstrap playbook. Resolves the shared-valkey DB 0 overlap with
paperless and isolates nextcloud's blast radius.

Nextcloud is being migrated to a dedicated namespace. Add the namespace,
replicate the cute-haus-tls wildcard cert into it, and stand up a
nextcloud-local valkey (256mb cap) so nextcloud no longer shares the
default-ns valkey's DB 0 with paperless.