feat: add usage statistics server

[vitormattos]

Summary

Build the first functional version of the usage statistics receiver as a native Nextcloud app.

• support Nextcloud 35 and 36
• derive supported PHP and Nextcloud CI boundaries from app metadata with nextcloud-version-matrix
• expose the OCS API with controller ApiRoute attributes instead of appinfo/routes.php
• generate and validate OpenAPI specifications from the controller contract
• generate TypeScript API types from the OpenAPI specifications
• validate PHP contracts with both Psalm and PHPStan, using the official Nextcloud PHPStan workflow pattern
• validate JavaScript/TypeScript with ESLint and TypeScript workflows
• enforce REUSE/SPDX compliance and keep canonical project/workflow licenses under LICENSES/
• keep Composer, npm and GitHub Actions dependencies monitored with Dependabot
• update the supported nextcloud/ocp development dependency with a scheduled workflow adapted from the Nextcloud template
• exercise test quality with Infection mutation testing and strengthen contract/boundary tests from escaped mutants
• expose an anonymous rate-limited report ingestion endpoint
• preserve immutable historical reports and materialize latest installation state separately
• identify reports by application, installation, and reporting period, independent of schema version
• make same-schema retries idempotent and reject schema changes within an existing period
• keep current installation state monotonic when historical reports arrive late or concurrent reports race
• store only normalized validated fields, without retaining the raw request payload
• store metric values in dedicated integer, number, boolean, and string columns
• return the same accepted response for new and idempotent report submissions without exposing database IDs
• strictly validate RFC3339 periods and reject unknown report/schema fields
• add versioned, immutable application metric schemas as an ingestion allowlist
• prevent incompatible metric semantics from changing across schema versions
• enforce each metric's registered aggregation contract in the statistics API
• provide categorical and numerical administrative aggregations
• define active reporting installations using a 45-day window
• add configurable historical retention with a daily cleanup job
• validate the app with SQLite, MySQL, MariaDB, and PostgreSQL workflows based on Nextcloud templates
• exercise the OCS contract end-to-end with Behat against the minimum and maximum supported runtime boundaries
• document protocol v1, application schemas, administrative API, retention, and the self-reported-data trust model

The API structure follows the same Nextcloud OCS/OpenAPI pattern used by LibreSign: OCSController, DataResponse, ApiRoute, OpenAPI scopes/tags, Psalm, PHPStan, openapi-extractor, generated OpenAPI JSON, and generated TypeScript models.

The design also uses nextcloud/survey_server as prior art for ingestion semantics, metric metadata, aggregation conventions, settings, and cleanup, while intentionally preserving historical reports instead of replacing each installation's previous snapshot.

Mutation testing covers 100% of the mutated code and reached a 97% covered-code MSI. The remaining escaped mutants are SQLite-equivalent database normalization casts and the idempotent-report fast path, so the project enforces a 97% MSI baseline without suppressing those mutants.