chore(quality): adopt the shared coding standard — gate-65 (14 deviations -> 0)

Closes the last of the eleven Hydra gates failing on `development`. It is split
out of the gate-fix PR on purpose: the config swap is small, the reformat it
implies touches every PHP file, and the two are easier to read apart.

WHAT THE GATE WAS SAYING
------------------------
Fourteen findings, but one story: this app carried its own private copy of every
quality config, and one of those copies contradicted the formatter it is meant
to agree with.

- `phpcs.xml` was a ~200-line PEAR-derived ruleset naming twenty formatting
  sniffs — indentation, brace placement, alignment, `elseif` — that php-cs-fixer
  owns. Two formatters with overlapping jurisdiction make an app UNFIXABLE:
  `cs:fix` and `phpcs` then demand opposite things and neither can be satisfied.
- `phpcs-custom-sniffs/` was a local copy of three shared sniffs. That is how the
  fleet reached six versions of NamedParametersSniff.php, one of them calling
  addWarning() where the rest called addError(). The vendored copy here is a
  superset — it additionally skips Entity magic accessors, which is a real
  correctness fix this app did not have.
- `phpmd.xml` was a full local copy; `phpmd-unusedparams.xml` likewise, with a
  narrower `exclude-pattern` comment than the package's.
- `phpstan.neon` re-typed the fleet-wide ignore list by hand.
- `cs:check` / `cs:fix` ran PHPCS. Those are nextcloud/coding-standard's script
  names, so a contributor running the documented Nextcloud command got this
  fleet's reformatting instead.
- `nextcloud/coding-standard` was a DIRECT dependency with no config and no
  invocation — loaded, and ready to reformat everything for whoever found it.
- no `.editorconfig`, so an editor fell back to whatever the developer last
  configured.
- `.prettierrc` existed but neither prettier nor a prettier-config package was a
  dependency, so nothing in CI ever ran it. It still applied in editors, which
  is the worst of both.
- the `stylelint` scripts passed an UNQUOTED `src/**/*.vue`. The shell expanded
  it, and without globstar `src/**/` matches exactly one directory level — so
  `src/views/widgets/`, `src/icons/`, `src/store/modules/` and every other nested
  component was silently never linted.

WHAT CHANGED
------------
- require-dev gains `conduction/hydra-gates` and `conduction/coding-standard`;
  `nextcloud/coding-standard` stops being direct and arrives transitively at the
  version conduction/coding-standard has tested against (it moved 1.4.0 -> 1.5.0
  as a result).
- `phpcs.xml`, `phpmd.xml`, `phpstan.neon` become the package's stubs. `<file>lib</file>`
  stays in the app stub deliberately: phpcs resolves `<file>` relative to the
  ruleset that DECLARES it, so a `<file>` in the package would resolve inside
  vendor/ and exit 3.
- `phpcs-custom-sniffs/` and `phpmd-unusedparams.xml` deleted; both now come from
  the package. Positive control rather than assumption — `phpcs --standard=phpcs.xml -e`
  lists CustomSniffs.Commenting.SpecTag, CustomSniffs.Functions.NamedParameters
  and CustomSniffs.Nextcloud.NoLegacyServerAccessors, i.e. all three still load.
- `.php-cs-fixer.dist.php` added, and lib/ + tests/ actually run through it. The
  `require_once` at the top is not optional: php-cs-fixer includes the config
  before the autoloader, and in --format=json that fatal reports as ZERO FILES
  NEEDING CHANGES, which reads exactly like a clean tree.
- `cs:check` / `cs:fix` now run php-cs-fixer, so the documented Nextcloud command
  does the Nextcloud thing.
- `.editorconfig` added (tab indent, matching Nextcloud core and the fixer).
- `.prettierrc` deleted — the gate's first option. The eslint.config.mjs comment
  that claimed "`prettier --check` runs as its own CI job" is corrected: it does
  not, and the open follow-up (adopt prettier properly, the way nextcloud/forms
  does) is written down there instead of implied.
- stylelint globs quoted. `npm run stylelint` now genuinely covers the nested
  directories and passes.
- `.gitignore` gains `.php-cs-fixer.cache` and `.phpunit.cache/`, both of which
  were untracked and unignored.

THE REFORMAT
------------
37 files, entirely mechanical: 4-space + next-line braces -> tab + K&R, which is
what nextcloud/coding-standard has always required. Nothing semantic moves; there
is no `header_comment` fixer in the standard, so every SPDX header is untouched,
and both baselines (phpstan-baseline.neon, psalm-baseline.xml) are empty, so
nothing goes stale.

MEASURED BEFORE AND AFTER, SAME FILES
-------------------------------------
  phpcs    0 errors / 30 warnings  ->  0 errors / 30 warnings   (identical; the
           30 are the shared SpecTagSniff, now sourced from the package)
  phpmd    clean -> clean
  psalm    clean -> clean
  phpstan  clean -> clean
  phpunit  66 unit tests green -> 66 green
  vitest   15 green -> 15 green
  stylelint  passed -> passes, over strictly more files
  hydra-gates  gate-65 FAIL (14) -> PASS; suite exit 0

`composer cs:check` is green for the first time — before this it was PHPCS
wearing php-cs-fixer's name.

Author: rubenvdlinde

.editorconfig

@@ -0,0 +1,36 @@
+# https://editorconfig.org
+
+# SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = tab
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size = 2
+indent_style = space
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.svg]
+insert_final_newline = false
+
+[package*.json]
+indent_size = 2
+indent_style = space
+
+[build/psalm-baseline.xml]
+indent_size = 2
+indent_style = space
+
+[config/*config.php]
+indent_size = 2
+indent_style = space

.gitignore

@@ -12,3 +12,7 @@
 tests/e2e/.auth/
 tests/e2e/test-results/
 tests/e2e/playwright-report/
+
+# php-cs-fixer + phpunit local caches
+.php-cs-fixer.cache
+.phpunit.cache/

.php-cs-fixer.dist.php

@@ -0,0 +1,20 @@
+<?php
+
+// SPDX-FileCopyrightText: 2026 Conduction B.V.
+// SPDX-License-Identifier: EUPL-1.2
+
+// The require_once is NOT optional. php-cs-fixer includes this file before the
+// app's autoloader runs, so without it the run dies with "Class not found" —
+// and in --format=json that fatal is reported as ZERO FILES NEEDING CHANGES,
+// which reads exactly like a clean tree.
+require_once __DIR__ . '/vendor/autoload.php';
+
+$config = new Conduction\CodingStandard\Config();
+$config->getFinder()
+    ->notPath('vendor')
+    ->notPath('node_modules')
+    ->notPath('build')
+    ->in(__DIR__ . '/lib')
+    ->in(__DIR__ . '/tests');
+
+return $config;

.prettierrc

@@ -23,9 +23,10 @@
 		"php": "^8.3"
 	},
 	"require-dev": {
+		"conduction/coding-standard": "^1.0",
+		"conduction/hydra-gates": "^1.9",
 		"cyclonedx/cyclonedx-php-composer": "^6.2",
 		"edgedesign/phpqa": "^1.27",
-		"nextcloud/coding-standard": "^1.4",
 		"nextcloud/ocp": "^34.0",
 		"phpcsstandards/phpcsextra": "^1.4",
 		"phpmd/phpmd": "^2.15",
@@ -38,12 +39,12 @@
 	},
 	"scripts": {
 		"lint": "find . -name \\*.php -not -path './vendor/*' -not -path './build/*' -print0 | xargs -0 -n1 php -l",
-		"cs:check": "./vendor/bin/phpcs --standard=phpcs.xml",
-		"cs:fix": "./vendor/bin/phpcbf --standard=phpcs.xml",
+		"cs:check": "./vendor/bin/php-cs-fixer fix --dry-run --diff",
+		"cs:fix": "./vendor/bin/php-cs-fixer fix",
 		"phpcs": "./vendor/bin/phpcs --standard=phpcs.xml",
 		"phpcs:fix": "./vendor/bin/phpcbf --standard=phpcs.xml",
 		"phpcs:output": "./vendor/bin/phpcs --standard=phpcs.xml --report=json lib/ 2>/dev/null | tail -1 > phpcs-output.json",
-		"phpmd": "E=0; ./vendor/bin/phpmd lib text phpmd.xml || E=$?; ./vendor/bin/phpmd lib text phpmd-unusedparams.xml || E=$?; exit $E",
+		"phpmd": "E=0; ./vendor/bin/phpmd lib text phpmd.xml || E=$?; ./vendor/bin/phpmd lib text vendor/conduction/hydra-gates/quality-config/phpmd-unusedparams.xml || E=$?; exit $E",
 		"phpmetrics": "./vendor/bin/phpmetrics --report-html=phpmetrics lib/",
 		"psalm": "./vendor/bin/psalm --threads=1 --no-cache",
 		"phpstan": "./vendor/bin/phpstan analyse --memory-limit=1G",