Adapt recipe to Docs v6 (yhub collaboration server)

- the new yhub service needs new initialisation and RSA keys
- SOFT_MIGRATION on by default, add migrate_documents command
- back up the yhub database too
- document the v5 -> v6 upgrade in README and release/next

Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md):

 #LLM_vibe
 #LLM_model Claude Opus 5.5

- [x] I take full responsibility for this code
- [x] I understand every line of this code
- [x] I tested this code thoroughly on my own computer / servers
- [x] None of the commit messages were created using LLMs
- [x] I will participate in any discussion on my own and will not use an LLM for the discussion

.env.sample

@@ -21,14 +21,16 @@ SECRET_DJANGO_SP_VERSION=v1
 SECRET_MINIO_RP_VERSION=v1
 # MINIO_ROOT_USER
 SECRET_MINIO_RU_VERSION=v1
-# COLLABORATION_SERVER_SECRET
-SECRET_COLLAB_SS_VERSION=v1
 # POSTGRES_PASSWORD
 SECRET_POSTGRES_P_VERSION=v1
 # Y_PROVIDER_API_KEY
 SECRET_Y_API_KEY_VERSION=v1
 # DJANGO_HOST_EMAIL_PASSWORD
 SECRET_EMAIL_PASS_VERSION=v1
+# JWT_PRIVATE_KEY of the backend (RSA PEM, must be inserted manually, see README)
+SECRET_JWT_PK_VERSION=v1 # generate=false
+# YHUB_JWT_PRIVATE_KEY of the collaboration server (RSA PEM, must be inserted manually, see README)
+SECRET_YHUB_JWT_PK_VERSION=v1 # generate=false
 
 ##############################################################################
 # EMAIL
@@ -106,3 +108,13 @@ LOGGING_LEVEL_LOGGERS_APP=INFO
 # Header the backend reads for media auth subrequests.
 # Upstream default matches the recipe's nginx config (X-Original-URL).
 # MEDIA_AUTH_ORIGINAL_URL_HEADER=HTTP_X_ORIGINAL_URL
+
+##############################################################################
+# COLLABORATION SERVER (yhub) - SOFT MIGRATION
+##############################################################################
+# Since v6 the document content lives in the collaboration server, not in the
+# media bucket. With SOFT_MIGRATION, a pre-v6 document is copied over the first
+# time it is opened. Only set to false once
+# `abra app cmd <app-name> backend migrate_documents` has covered all documents
+# (or on a fresh v6 install); unmigrated documents would otherwise open empty.
+# SOFT_MIGRATION=true