Fix Nextcloud WireGuard route generation

[kappisj]

What changed

• write the Nextcloud code-server include to wg_modules.conf when WG_ACCESS_NEXTCLOUD contains wg
• keep the existing public include behavior for pub

Why

The wg branch currently writes code-server-ext.conf to ext_modules.conf. A WireGuard-only Nextcloud configuration can therefore expose the code-server routes on the public bridge listener.

Fixes part of #35.

Impact

WG_ACCESS_NEXTCLOUD=wg now keeps both Nextcloud and its code-server routes on the WireGuard listener. pub and wg,pub retain their intended public behavior.

Validation

• bash -n docker/compose/assets/web/web-services-configure.sh
• static assertions for the wg and external output targets
• git diff --check