fix(template): headers+SPDX, observability controllers, example openspec (supersedes #19/#20/#22)

[rubenvdlinde]

Summary

Consolidates the unique, still-unmerged work from three stale PRs whose branches predated the manifest-renderer refactor (hydra ADR-024) and could not be merged without reverting it. Reapplied freshly on current development (which now also includes the ADR-023 ActionAuthService from #21).

Supersedes and closes #19, #20, #22.

Headers / SPDX / @SPEC (was #19)

• Fix the propagated dev@conductio.nl → info@conduction.nl typo across all 10 template PHP files — root-cause fix; the typo had spread fleet-wide via scaffolds.
• Bump @copyright 2024 → 2026; add SPDX-FileCopyrightText + SPDX-License-Identifier inside the main docblock (after @license), matching the canonical format already used by lib/Mcp/ExampleToolProvider.php.
• Add the file-level @spec example to Application.php (ADR-003).

Observability + REUSE (was #20)

• Add HealthController + MetricsController. appinfo/routes.php already declared metrics#index and health#index, but the classes were missing, so /api/health and /api/metrics returned 500. Health is @PublicPage + verifies OpenRegister; Metrics is admin-only Prometheus text with {app}_info + {app}_health_status (ADR-006).
• Add REUSE.toml for non-PHP source files.

Example OpenSpec (was #22)

• Populate openspec/changes/example-change/ + 7 openspec/specs/ capabilities that the @spec docblock tags point at (previously dead links).
• Adapted task-5 / item-management / design.md to the current layout: the removed ItemController/ItemService demo is replaced by ActionAuthService (ADR-023, feat(adr-023): ActionAuthService skeleton + repair step + empty seed + unit tests #21) as the per-object-auth illustration.

Test plan

• php -l clean on all 12 modified/added PHP files
• npm run check:specs passes (json-strict + manifest + register + registry)
• Scaffold a new app and verify curl /api/health returns JSON and curl /api/metrics returns Prometheus text

[github-actions]

Quality Report — ConductionNL/nextcloud-app-template @ efc8cc9

Check	PHP	Vue	Security	License	Tests
lint	❌
phpcs	❌
phpmd	❌
psalm	❌
phpstan	❌
phpmetrics	❌
eslint		❌
stylelint		❌
composer			❌	❌
npm			✅	❌ 2/684 denied
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

❌ Denied npm licenses

Package	Version	License
pako	1.0.11	(MIT AND Zlib)
sha.js	2.4.12	(MIT AND BSD-3-Clause)

---

Quality workflow — 2026-05-25 15:56 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Holding this open: the red CI checks are a pre-existing npm ci ERESOLVE conflict that also fails on development itself — tracked in #62. They fail at the dependency-install step, before any of this PR's content is evaluated. This PR's own changes are PHP/TOML/markdown only and are green locally (php -l clean on all 12 files, npm run check:specs passes). It is MERGEABLE and ready to merge once #62 unblocks install. I did not force the legacy-peer-deps workaround here because .npmrc propagates to every scaffolded app and that's a fleet-wide decision, not a PR-triage side effect.

[github-actions]

Quality Report — ConductionNL/nextcloud-app-template @ c6bc3bd

Check	PHP	Vue	Security	License	Tests
lint	❌
phpcs	❌
phpmd	❌
psalm	❌
phpstan	❌
phpmetrics	❌
eslint		✅
stylelint		✅
composer			❌	❌
npm			✅	✅ 597/597
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-05-25 18:00 UTC

Download the full PDF report from the workflow artifacts.