ci(deploy): split runtime by k8s/active marker

services marked k8s/active are applied via kubectl; the rest via docker
compose. inactive services with k8s/ keep only routing manifests
(external Services, EndpointSlices, Ingresses) to reach docker backends.
headscale/nextcloud routing moved to k8s/routing/.

validations: compose config --quiet + kubectl apply --dry-run=client.
namespace manifests applied first. pull_policy:build stacks get
build+push before up so the registry image stays fresh.

nextcloud/k8s/routing/external-service.yaml

@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-apache
+  namespace: nextcloud
+spec:
+  ports:
+    - port: 11000
+      targetPort: 11000
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: nextcloud-apache
+  namespace: nextcloud
+  labels:
+    kubernetes.io/service-name: nextcloud-apache
+addressType: IPv4
+ports:
+  - port: 11000
+    protocol: TCP
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-aio
+  namespace: nextcloud
+spec:
+  ports:
+    - port: 8888
+      targetPort: 8888
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: nextcloud-aio
+  namespace: nextcloud
+  labels:
+    kubernetes.io/service-name: nextcloud-aio
+addressType: IPv4
+ports:
+  - port: 8888
+    protocol: TCP
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+    conditions:
+      ready: true