feat(discourse): switch app to official discourse/discourse image (experimental)

Replaces the paywalled bitnamilegacy app with the official discourse/discourse
image behind Traefik (HTTP-only via an install-ssl override; sidekiq is internal
so its service is dropped). DB is reused as-is; uploads migrate from a legacy
bitnami volume via an idempotent, non-destructive runit hook. db keeps
pgvector/pgvector:pg17 with the install-user-aware pg_upgrade entrypoint.

Verified on cctest: fresh install, upgrade-from-bitnami-pg17, and
upgrade-from-bitnami-pg13 (incl. 13->17) all serve with data intact.
Upstream marks discourse/discourse experimental; hold prod cutover.

Recipe 0.8.1+3.5.0 -> 1.0.0+3.5.3 (major: new image, env/volume/port changes).

cc-app-entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Co-op Cloud wrapper around the official image's /sbin/boot.
+# discourse/discourse reads DISCOURSE_DB_PASSWORD from the process env (pups/Ruby;
+# it has no *_FILE support), so inject it from the docker secret before booting.
+set -e
+
+if [ -f /run/secrets/db_password ]; then
+  export DISCOURSE_DB_PASSWORD="$(cat /run/secrets/db_password)"
+fi
+
+exec /sbin/boot