feat(db): switch to discourse/postgres image (auto-upgrade)

Move the db off the bitnami-era pgvector:pg17 + hand-rolled pg_upgrade entrypoint
to discourse/postgres:pg18 (pgvector + discourse's auto-upgrade layer). The image
runs the in-place major-version pg_upgrade itself on boot; the recipe configures it
via env:

- a small inline entrypoint injects the db password secret into $DB_PASSWORD (the
  image expects it in the env, no *_FILE support)
- POSTGRES_USER (the install user pg_upgrade must match) defaults to 'postgres' --
  correct for fresh installs and bitnami-origin clusters -- overridable from .env
- POSTGRES_INITDB_ARGS=--no-data-checksums so the new pg18 cluster matches pre-18
  clusters (pg18 initdb enables checksums by default; pg_upgrade needs a match)

- mount postgresql_data at /var/lib/postgresql (versioned PGDATA .../18/docker)
- pg_backup.sh uses POSTGRES_USER for the dump/drop/recreate; fix paths
- document the POSTGRES_USER override in .env.sample, README and the release note
- drop entrypoint.postgres.sh.tmpl

Tested on cctest: pg17->pg18 upgrade preserves data and serves over HTTPS; fresh
install works; backup+restore round-trips.

pg_backup.sh

@@ -1,44 +1,47 @@
 #!/bin/bash
 
-# Postgres backup/restore hook for the discourse `db` service.
+# Postgres backup/restore hook for the discourse `db` service (discourse/postgres image).
 
 set -e
 
-BACKUP_FILE='/var/lib/postgresql/data/backup.sql'
-export PGPASSWORD=$(cat "${POSTGRES_PASSWORD_FILE:-/run/secrets/db_password}")
-DB_USER="${POSTGRES_USER:-discourse}"
+# dump goes at the volume root so backupbot's backup.sql label finds it
+BACKUP_FILE='/var/lib/postgresql/backup.sql'
+DATADIR="${PGDATA:-/var/lib/postgresql/18/docker}"
 DB_NAME="${POSTGRES_DB:-discourse}"
 
+# bootstrap superuser for the dump/drop/recreate; same POSTGRES_USER the db service sets
+SU="${POSTGRES_USER:-postgres}"
+
 function backup {
-  pg_dump -U "$DB_USER" "$DB_NAME" | gzip > "$BACKUP_FILE"
+  pg_dump -U "$SU" "$DB_NAME" | gzip > "$BACKUP_FILE"
 }
 
 function restore {
-  cd /var/lib/postgresql/data/
+  cd "$DATADIR"
 
   # Block all non-local connections so the running discourse app + sidekiq cannot reconnect and
   # interfere with the drop/recreate/reimport. Restored on exit.
   restore_hba() {
     cat pg_hba.conf.bak > pg_hba.conf
     rm -f pg_hba.conf.bak
-    su postgres -c 'pg_ctl reload'
+    su postgres -c "pg_ctl -D '$DATADIR' reload"
   }
   cp pg_hba.conf pg_hba.conf.bak
   echo 'local all all trust' > pg_hba.conf
-  su postgres -c 'pg_ctl reload'
+  su postgres -c "pg_ctl -D '$DATADIR' reload"
   trap restore_hba EXIT INT TERM
 
   # terminate any lingering local sessions before recreate
   # see https://stackoverflow.com/questions/5108876/kill-a-postgresql-session-connection
-  psql -U "$DB_USER" -d postgres -c \
+  psql -U "$SU" -d postgres -c \
     "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname='${DB_NAME}' AND pid<>pg_backend_pid();"
 
   # drop database and then recreate it
-  psql -U "$DB_USER" -d postgres -c "DROP DATABASE ${DB_NAME} WITH (FORCE);"
-  createdb -U "$DB_USER" "$DB_NAME"
+  psql -U "$SU" -d postgres -c "DROP DATABASE ${DB_NAME} WITH (FORCE);"
+  createdb -U "$SU" "$DB_NAME"
 
-  # reimport data 
-  gunzip -c "$BACKUP_FILE" | psql -U "$DB_USER" -d "$DB_NAME" -1 -v ON_ERROR_STOP=1 -f -
+  # reimport data
+  gunzip -c "$BACKUP_FILE" | psql -U "$SU" -d "$DB_NAME" -1 -v ON_ERROR_STOP=1 -f -
 }
 
 $@