epic(admin): manage a Nextcloud server natively

[veryCrunchy]

Outcome

Provide a dedicated, permission-gated administration workspace for managing a Nextcloud server without replacing or contaminating the normal user Apps experience.

Administration areas

• users, groups, roles, quotas, lifecycle, and account recovery
• installed apps, app discovery, updates, enable/disable state, compatibility, and removal
• server-wide and app-specific administration settings
• security policies, sessions, devices, app passwords, sharing, federation, and brute-force controls
• storage, external storage, background jobs, cron health, maintenance state, logs, notifications, and system status
• email, theming, workflow, retention, and other capabilities exposed by installed apps

Product rules

• Admin is a separate workspace visible only when verified server capabilities and permissions allow it.
• Read and write capabilities are discovered independently; unavailable mutations remain disabled.
• Context-aware forms use actual resource identifiers and verified option sources rather than raw ID fields.
• Destructive, security-sensitive, and availability-impacting actions require clear impact summaries and confirmation.
• Long-running operations expose progress, cancellation where safe, completion, and recovery states.
• Secrets are never echoed, cached in screenshots, logs, analytics, or fixtures.
• Audit-friendly local history records what action was requested and its result without storing sensitive payloads.
• Dynamic settings render through reusable typed controls, while app-specific hints are allowed when they materially improve safety or comprehension.

Acceptance criteria

• administrator and non-administrator accounts see correctly separated navigation and permissions
• every supported setting has read, edit, validation, error, refresh, and permission-denied behavior
• user, app, security, and server-health areas have native mobile and desktop layouts
• all writes are backed by verified API contracts or documented DAV/OCS capabilities
• risky operations have focused tests for incorrect IDs, stale state, partial failure, retry, and cross-account isolation
• the administration workspace remains usable with hundreds of users/apps and large paged logs
• synthetic privacy-safe fixtures support deterministic UI tests and screenshots

Child issues split the epic into independently reviewable user, app, settings, security, and operations work.