feat(discourse): switch app to official discourse/discourse image (experimental)

Replaces the paywalled bitnamilegacy app with the official discourse/discourse
image behind Traefik. DB is reused as-is; uploads migrate from the legacy
bitnami volume idempotently. The wrapper entrypoint injects the db_password and
smtp_password secrets (the official image has no *_FILE support). SMTP env vars
are renamed to the official names; release notes cover the migration.

Recipe 0.8.1+3.5.0 -> 1.0.0+3.5.3 (major: new image, env/volume/port changes).

migrate-uploads.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# One-time, idempotent, NON-destructive migration of uploads + backups from a
+# legacy bitnami discourse volume into the official image's /shared.
+#
+# Runs on every boot as a runit 1.d hook but no-ops after the first success
+# (sentinel) and when there is no legacy volume mounted (fresh installs). It only
+# ever COPIES from the read-only /legacy mount, so an interruption just re-copies
+# on the next boot — there is no move/delete to leave the data half-migrated.
+set -e
+
+SENTINEL=/shared/.bitnami-uploads-migrated
+[ -e "$SENTINEL" ] && exit 0
+
+if [ -d /legacy/public/uploads ]; then
+  echo "[migrate-uploads] copying bitnami uploads/backups -> /shared"
+  mkdir -p /shared/uploads /shared/backups
+  cp -a /legacy/public/uploads/. /shared/uploads/ 2>/dev/null || true
+  cp -a /legacy/public/backups/. /shared/backups/ 2>/dev/null || true
+  # discourse runs as uid 1000; the official boot also chowns /shared, but be explicit
+  chown -R discourse:discourse /shared/uploads /shared/backups 2>/dev/null || true
+  echo "[migrate-uploads] done"
+fi
+
+touch "$SENTINEL"