move to a private nextcloud instance

in #31540 (moved), we agreed to delegate running a dedicated Nextcloud instance to riseup.

this ticket tracks the next steps, so far:

1. create the private instance (riseup)
2. point DNS at the private instance (TPA)
3. make sure HTTPS works (riseup?)
4. #32332 (moved) set up LDAP integration, somehow (service admins + riseup)
5. move content and users over (gaba + pili + teams)