IONOS(password_policy): NC32 fork release (NSW-946)

[printminion-co]

Summary

NC32 IONOS password_policy line: upstream v32.0.14 + rebased IONOS patches.

• Integration branch ionos-dev-v32 = vanilla v32.0.14.
• This PR adds the IONOS commits on top.

Reconciliation against v32.0.14

IONOS commit	Outcome
b2ba6de IONOS(admin-delegation): implement IDelegatedSettings for password policy	kept — upstream still declares implements ISettings at v32.0.14, so the delegation patch is not redundant

The cherry-pick applied cleanly: this class is unchanged at v32.0.14 apart from unrelated code,
and it carries no #[\Override] attributes, so none were added.

Pre-existing base failure

Psalm reports DocblockTypeContradiction at lib/Validator/HIBPValidator.php:54. This
reproduces on bare v32.0.14 with no IONOS commits applied, so it is not introduced by this PR
and is not fixed here.

Commit hashes are unformatted so GitHub auto-links them.

Consumed by IONOS-Productivity/ncw-server via a submodule bump after merge + tag.

Jira: NSW-946

[printminion-co]

Why most checks are stuck queued

These are not failures and they will not clear on their own.

These forks inherit the upstream Nextcloud workflows, most of which pin runs-on: ubuntu-latest-low
— a runner label that exists in the nextcloud org but not in IONOS-Productivity
(repos/.../actions/runners reports 0). Those jobs queue indefinitely; only the ubuntu-latest
ones ever execute.

Fork	ubuntu-latest-low	ubuntu-latest
nc-activity	30	22
nc-bruteforcesettings	32	17
nc-password_policy	26	16

This is pre-existing, not caused by these PRs: nc-bruteforcesettings has never had a successful
PHPUnit run in its history — the single attempt, on kh/dev/delegate-admin-settings in Feb 2026
(the branch that produced the very commit cherry-picked here), was cancelled. Worth its own ticket;
out of scope here.

Judge these PRs on the checks that can run. Psalm is among them, and it is the check that would
catch a broken IDelegatedSettings implementation.

On this PR the runnable checks are: php-cs ✅, stylelint ✅, openapi ✅. The only red is
static-psalm-analysis, which is a base failure — it dies during dependency install, before
analysing any code:

Root composer.json requires nextcloud/ocp dev-master -> requires php ~8.3 || ~8.4 || ~8.5
-> your php version (8.1; overridden via config.platform) does not satisfy that requirement

This PR does not touch composer at all — git diff v32.0.14..HEAD -- composer.json composer.lock
is empty. The vanilla v32.0.14 composer.json pins config.platform.php: 8.1 while its
nextcloud/ocp: dev-master dev-dependency now demands PHP ≥ 8.3.

[printminion-co]

Upstreaming of this patch is now in flight — see #3 (internal review) and nextcloud#1023 (upstream). Tracked in Jira as NSW-813, parked in the "Waiting for NC/Collabora" sprint.

This PR still needs to merge as-is: the fork keeps carrying the patch on the NC32 line until Nextcloud merges and releases the upstream change. Server PR: IONOS-Productivity/ncw-server#324.