bump to 0.3.2+v5.1.0

Wire up the file-upload conversion path that CONVERSION_UPLOAD_ENABLED
exposes:

- Add Y_PROVIDER_API_BASE_URL and Y_PROVIDER_API_KEY_FILE to common-env
  so the backend can call y-provider (used for .md→Yjs).
- Add DOCSPEC_API_URL to common-env and a new docspec service
  (ghcr.io/docspecio/api:3.0.1) for the .docx→BlockNote→Yjs path.

These were missing because they were dormant while
CONVERSION_UPLOAD_ENABLED defaulted to false upstream. Now that the
recipe defaults it to true (0.3.1+v5.1.0), they're required for the
upload endpoint to function.

Upstream reference:
- https://github.com/suitenumerique/docs/blob/v5.1.0/compose.yml (docspec service)
- https://github.com/suitenumerique/docs/blob/v5.1.0/env.d/development/common (DOCSPEC_API_URL, Y_PROVIDER_API_BASE_URL)
- https://github.com/docspecio/api (DocSpec source)

compose.yml

@@ -66,6 +66,11 @@ x-common-env: &common-env
   CONVERSION_API_CONTENT_FIELD:
   CONVERSION_API_TIMEOUT:
   CONVERSION_API_SECURE:
+  # Y-Provider base URL + API key (needed when CONVERSION_UPLOAD_ENABLED is true)
+  Y_PROVIDER_API_BASE_URL: http://y-provider:4444/api/
+  Y_PROVIDER_API_KEY_FILE: /run/secrets/y_api_key
+  # DocSpec — converts .docx → BlockNote JSON, then y-provider turns that into Yjs
+  DOCSPEC_API_URL: http://docspec:4000/conversion
   # Database connection pool
   DB_PSYCOPG_POOL_ENABLED:
   # Media auth header (matches recipe nginx by default)
@@ -105,7 +110,7 @@ services:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.3.1+v5.1.0"
+        - "coop-cloud.${STACK_NAME}.version=0.3.2+v5.1.0"
     user: "${DOCKER_USER:-1000}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080"]
@@ -198,6 +203,19 @@ services:
     secrets:
       - y_api_key
 
+  docspec:
+    image: ghcr.io/docspecio/api:3.0.1
+    networks:
+      - backend
+    healthcheck:
+      # /conversion only accepts POST; any HTTP response (e.g. 404/405) means the server is up.
+      # wget exit 4 = network error (server down); anything else = server responded.
+      test: ["CMD-SHELL", "wget -qO /dev/null http://localhost:4000/conversion 2>/dev/null; test $$? -ne 4"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
   db:
     image: pgautoupgrade/pgautoupgrade:18-debian
     networks: