feat: support Git LFS on plain gitea

Add an opt-in compose.lfs.yml that mounts the lfs_jwt_secret secret and
enables GITEA_LFS_START_SERVER for plain gitea (forgejo already bundles
LFS). Emit LFS_JWT_SECRET in app.ini whenever the LFS server is on so the
JWT secret is stable across redeploys instead of being regenerated on
every restart (app.ini is a read-only config mount).

Bump version 3.5.2 -> 3.6.0.

compose.lfs.yml

@@ -0,0 +1,13 @@
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - GITEA_LFS_START_SERVER=true
+    secrets:
+      - lfs_jwt_secret
+
+secrets:
+  lfs_jwt_secret:
+    name: ${STACK_NAME}_lfs_jwt_secret_${SECRET_LFS_JWT_SECRET_VERSION}
+    external: true