feat(discourse): switch app to official discourse/discourse image (experimental)

Replaces the paywalled bitnamilegacy app with the official discourse/discourse
image behind Traefik (HTTP-only via an install-ssl override; sidekiq is internal
so its service is dropped). DB is reused as-is; uploads migrate from a legacy
bitnami volume via an idempotent, non-destructive runit hook. db keeps
pgvector/pgvector:pg17 with the install-user-aware pg_upgrade entrypoint, plus
db/redis healthchecks and updated README metadata.

The official image has no *_FILE support, so the wrapper entrypoint reads both
the db_password and smtp_password secrets and exports DISCOURSE_DB_PASSWORD /
DISCOURSE_SMTP_PASSWORD before booting. SMTP env vars are renamed to the
official names; release notes document the migration for operators.

Verified on cctest: fresh install, upgrade-from-bitnami-pg17, and
upgrade-from-bitnami-pg13 (incl. 13->17) all serve with data intact.
Upstream marks discourse/discourse experimental; hold prod cutover.

Recipe 0.8.1+3.5.0 -> 1.0.0+3.5.3 (major: new image, env/volume/port changes).

app-install-ssl.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Overrides the official image's /etc/runit/1.d/install-ssl.
+#
+# The stock install-ssl always runs configure-ssl (and configure-letsencrypt),
+# which empties the default `listen 80` nginx outlet and switches to `listen 443
+# ssl` against a cert that does not exist here — nginx then crash-loops, or the
+# image tries to obtain its own Let's Encrypt cert. Under Co-op Cloud, Traefik
+# terminates TLS and proxies plain HTTP to port 80, so we skip the image's SSL
+# setup entirely and let nginx keep its default HTTP-on-80 config.
+echo "install-ssl overridden by recipe: serving plain HTTP on :80 behind Traefik"
+exit 0