refactor(deck): address PR #872 round-1 review

- deck_get_stack: fetch active + archived concurrently for status="all", and
  for status="archived" source the stack from /stacks/archived in a single
  call (skip the active fetch whose open cards are filtered out anyway),
  matching deck_get_cards' pattern.
- Type the `client` param of _archived_cards_by_stack as NextcloudClient.
- Extend the stacks/overview integration test to assert status="archived"
  (only the archived card) in addition to status="all".
- Document the third_party/astrolabe submodule mount policy in CLAUDE.md:
  unmounted by default (CI installs the published app-store version); mount
  only for tightly-coupled feature work needing CI integration, then revert.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -223,6 +223,20 @@ docker compose up --build -d mcp-login-flow  # Login Flow v2 (port 8004)
 docker compose up --build -d mcp-keycloak  # Keycloak OAuth (port 8002)
 ```
 
+### Astrolabe submodule mount (do NOT mount by default)
+
+The `third_party/astrolabe` submodule mount in `docker-compose.yml`
+(`./third_party/astrolabe:/opt/apps/astrolabe:ro`) is **commented out by
+default and should stay that way**. With it unmounted, the stack installs the
+most recently **published** Astrolabe version from the Nextcloud app store —
+which is the correct baseline for almost all work, including CI.
+
+Only uncomment the mount when developing features that are **tightly coupled**
+to unreleased Astrolabe changes and need the local submodule build integration-
+tested in CI. Re-comment it before the change is considered done — a left-on
+mount silently pins CI to the local checkout instead of the published app, and
+breaks for anyone without the submodule built. (See PR #872.)
+
 ### Environment Setup
 ```bash
 uv sync                # Install dependencies