upstream(lasuite-docs): v6 yhub stack, runtime RSA keys, docspec 1.x

cc-ci-plan/upstream/lasuite-docs.md

@@ -6,6 +6,9 @@
 | backend | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
 | celery | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
 | y-provider | lasuite/impress-y-provider | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
+| yhub | lasuite/impress-yhub | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
+| yhub-valkey | valkey/valkey | https://github.com/valkey-io/valkey | https://github.com/valkey-io/valkey/releases |
+| jwt-keys | lasuite/impress-yhub (Node crypto sidecar) | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/blob/main/UPGRADE.md |
 | docspec | ghcr.io/docspec/api | https://github.com/docspec/docspec | https://github.com/docspec/docspec/releases |
 | db | pgautoupgrade/pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade/releases |
 | redis | redis | https://github.com/redis/redis | https://hub.docker.com/_/redis/tags |
@@ -13,8 +16,20 @@
 | web | nginx | https://github.com/nginx/nginx | https://nginx.org/en/CHANGES |
 
 ## Standing notes
-- impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider all
+- **v6.0.x replaces the collaboration server**: hocuspocus/y-provider collaboration is gone; a new
-  share the same version tag from the suitenumerique/docs monorepo. Upgrade all four in lockstep.
+  `yhub` service (port 3002) serves `/collaboration/*`, with its own `yhub` PostgreSQL database and a
+  Valkey store. `y-provider` is conversion-only. New RSA keys (`JWT_PRIVATE_KEY_FILE` backend,
+  `YHUB_JWT_PRIVATE_KEY_FILE` yhub), `COLLABORATION_SERVER_SECRET` removed. Docs must be migrated into
+  yhub (`SOFT_MIGRATION=true` + `backend migrate_documents`). See UPGRADE.md `[6.0.0]`.
+- **v6.0.2** moves yhub to `@y/hub 0.10.1`, adding the `yhub_ydoc_versions_v1` table/indexes: re-run the
+  yhub schema script (`init-db`) — the recipe does it on every yhub start.
+- **The recipe generates the two RSA keys at runtime** into a `jwt_keys` volume (`jwt-keys` sidecar)
+  because abra cannot generate PEM secrets (`generate=false`) and Swarm secrets must pre-exist.
+- **docspec**: since Docs v5.7.0 the Rust `ghcr.io/docspec/api` (port 3000) replaces the archived Elixir
+  `ghcr.io/docspecio/api` (port 4000); Docs v6.0.2 expects `DOCSPEC_API_URL=http://docspec:3000/conversion`.
+- impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider,
+  impress-yhub (and the jwt-keys sidecar image) all share the same version tag from the
+  suitenumerique/docs monorepo. Upgrade all of them in lockstep.
 - AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
 - Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades;
   check manually on https://github.com/minio/minio/releases.