Adapt recipe to Docs v6 (yhub collaboration server)

- the new yhub service needs new initialisation and RSA keys
- SOFT_MIGRATION on by default, add migrate_documents command
- back up the yhub database too
- document the v5 -> v6 upgrade in README and release/next

Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md):

 #LLM_vibe
 #LLM_model Claude Opus 5.5

- [x] I take full responsibility for this code
- [x] I understand every line of this code
- [x] I tested this code thoroughly on my own computer / servers
- [x] None of the commit messages were created using LLMs
- [x] I will participate in any discussion on my own and will not use an LLM for the discussion

compose.yml

@@ -54,8 +54,10 @@ x-common-env: &common-env
   OPENAI_SDK_BASE_URL: https://openaiendpoint.com
   OPENAI_SDK_API_KEY: password
   AI_MODEL: llama
-  # Collaboration
-  COLLABORATION_API_URL: https://$DOMAIN/collaboration/api/
+  # Collaboration server (yhub), reached in-stack
+  YHUB_API_BASE_URL: http://yhub:3002
+  # RSA key signing the tokens the backend presents to yhub and y-provider
+  JWT_PRIVATE_KEY_FILE: /run/secrets/jwt_pk
   # Email app URL (used in email templates; matches recipe DOMAIN)
   DJANGO_EMAIL_URL_APP: "https://${DOMAIN}"
   # Conversion (file upload → Yjs via y-provider)
@@ -91,11 +93,26 @@ x-postgres-env: &postgres-env
 x-yprovider-env: &yprovider-env
   COLLABORATION_LOGGING: "true"
   # Y_PROVIDER_API_KEY supplied via secrets
-  COLLABORATION_API_URL: http://y-provider:4444/api/
   COLLABORATION_SERVER_ORIGIN: https://${DOMAIN}
-  # COLLABORATION_SERVER_SECRET supplied via secrets
   COLLABORATION_BACKEND_BASE_URL: https://${DOMAIN}
-  COLLABORATION_WS_URL: wss://${DOMAIN}/collaboration/ws/
+  # The last segment is YHUB_ORG (default: docs)
+  COLLABORATION_WS_URL: wss://${DOMAIN}/collaboration/ws/v1/docs
+
+x-yhub-env: &yhub-env
+  PORT: 3002
+  REDIS: redis://yhub-valkey:6379
+  # POSTGRES is built from the postgres_p secret in the entrypoint
+  COLLABORATION_BACKEND_BASE_URL: https://${DOMAIN}
+  COLLABORATION_SERVER_ORIGIN: https://${DOMAIN}
+  Y_PROVIDER_API_KEY_FILE: /run/secrets/y_api_key
+  YHUB_JWT_PRIVATE_KEY_FILE: /run/secrets/yhub_jwt_pk
+  # Seed documents from the pre-v6 media bucket the first time they are opened.
+  # Only turn off once `abra app cmd <app> backend migrate_documents` covered all documents.
+  SOFT_MIGRATION: "${SOFT_MIGRATION:-true}"
+  LEGACY_S3_ENDPOINT_URL: http://minio:9000
+  LEGACY_S3_ACCESS_KEY_ID_FILE: /run/secrets/minio_ru
+  LEGACY_S3_SECRET_ACCESS_KEY_FILE: /run/secrets/minio_rp
+  LEGACY_S3_BUCKET_NAME: docs-media-storage
 
 x-minio-env: &minio-env
   MINIO_ROOT_USER_FILE: /run/secrets/minio_ru
@@ -147,12 +164,12 @@ services:
       - django_sk
       - django_sp
       - oidc_rpcs
-      - collab_ss
       - minio_rp
       - minio_ru
       - postgres_p
       - y_api_key
       - email_pass
+      - jwt_pk
 
   celery:
     image: lasuite/impress-backend:v6.0.1
@@ -177,13 +194,55 @@ services:
       - django_sk
       - django_sp
       - oidc_rpcs
-      - collab_ss
       - minio_rp
+      - minio_ru
       - postgres_p
       - y_api_key
       - email_pass
+      - jwt_pk
 
+  # Collaboration server: serves the websocket and holds the document content
+  yhub:
+    image: lasuite/impress-yhub:v6.0.1
+    networks:
+      - backend
+    environment: *yhub-env
+    user: "${DOCKER_USER:-1000}"
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://localhost:3002/collaboration/ready/v1').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
+      interval: 15s
+      timeout: 5s
+      retries: 20
+      start_period: 30s
+    # The server never creates its schema: run the idempotent init-db before every start
+    entrypoint: >
+      sh -c "export POSTGRES=\"postgres://docs:$$(node -e 'process.stdout.write(encodeURIComponent(require(\"fs\").readFileSync(\"/run/secrets/postgres_p\",\"utf8\").trim()))')@db:5432/yhub\" && node node_modules/@y/hub/bin/init-db.js && exec /usr/local/bin/entrypoint \"$$@\"" --
+    command: ["node", "--import", "./dist/sentry.js", "dist/server.js"]
+    secrets:
+      - postgres_p
+      - y_api_key
+      - yhub_jwt_pk
+      - minio_ru
+      - minio_rp
 
+  # Valkey of yhub: holds updates not yet persisted to postgres, so it is a store, not a cache
+  yhub-valkey:
+    image: valkey/valkey:8.1.10-alpine
+    command: ["valkey-server", "--maxmemory-policy", "volatile-lru", "--appendonly", "yes", "--appendfsync", "everysec"]
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+    networks:
+      - backend
+    volumes:
+      - yhub_valkey:/data
+    deploy:
+      labels:
+        backupbot.backup: "${ENABLE_BACKUPS:-true}"
+
+  # Conversion service only since v6 (no longer serves the collaboration)
   y-provider:
     image: lasuite/impress-y-provider:v6.0.1
     networks:
@@ -233,7 +292,7 @@ services:
       labels:
         backupbot.backup: "${ENABLE_BACKUPS:-true}"
         backupbot.backup.pre-hook: "/pg_backup.sh backup"
-        backupbot.backup.volumes.postgres.path: "backup.sql"
+        backupbot.backup.volumes.postgres.path: "backup.sql,backup-yhub.sql"
         backupbot.restore.post-hook: '/pg_backup.sh restore'
     configs:
         - source: pg_backup
@@ -320,6 +379,7 @@ networks:
 volumes:
   postgres:
   minio:
+  yhub_valkey:
 
 configs:
   nginx_conf:
@@ -352,9 +412,12 @@ secrets:
   postgres_p:
     external: true
     name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION}
-  collab_ss:
+  jwt_pk:
     external: true
-    name: ${STACK_NAME}_collab_ss_${SECRET_COLLAB_SS_VERSION}
+    name: ${STACK_NAME}_jwt_pk_${SECRET_JWT_PK_VERSION}
+  yhub_jwt_pk:
+    external: true
+    name: ${STACK_NAME}_yhub_jwt_pk_${SECRET_YHUB_JWT_PK_VERSION}
   minio_rp:
     external: true
     name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION}