Adapt recipe to Docs v6 (yhub collaboration server)

- the new yhub service needs new initialisation and RSA keys
- SOFT_MIGRATION on by default, add migrate_documents command
- back up the yhub database too
- document the v5 -> v6 upgrade in README and release/next

Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md):

 #LLM_vibe
 #LLM_model Claude Opus 5.5

- [x] I take full responsibility for this code
- [x] I understand every line of this code
- [x] I tested this code thoroughly on my own computer / servers
- [x] None of the commit messages were created using LLMs
- [x] I will participate in any discussion on my own and will not use an LLM for the discussion

nginx.conf.tmpl

@@ -47,7 +47,14 @@ server {
         try_files $uri @proxy_to_docs_backend;
     }
     
-    # Proxy auth for collaboration server
+    location /external_api {
+        try_files $uri @proxy_to_docs_backend;
+    }
+
+    # Collaboration server (yhub). Only the routes below are published: it also
+    # serves prune, create-ydoc, reset-connections, migrate, restore-ydoc and
+    # reset-ydoc, which the backend calls in-stack and which must not be
+    # reachable from the outside.
     location /collaboration/ws/ {
         # Ensure WebSocket upgrade
         proxy_http_version 1.1;
@@ -55,7 +62,7 @@ server {
         proxy_set_header Connection "Upgrade";
 
         # Collaboration server
-        proxy_pass http://y-provider:4444;
+        proxy_pass http://{{ env "STACK_NAME" }}_yhub:3002;
 
         # Set appropriate timeout for WebSocket
         proxy_read_timeout 86400;
@@ -67,9 +74,11 @@ server {
         proxy_set_header Host $host;
     }
 
-    location  /collaboration/api/ {
-        # Collaboration server
-        proxy_pass http://y-provider:4444;
+    # Document routes (http fallback, history) and the public keys of yhub
+    location ~ ^/collaboration/(ydoc|activity|changeset|rollback|jwks)/ {
+        proxy_pass http://{{ env "STACK_NAME" }}_yhub:3002;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header Origin $http_origin;
         proxy_set_header Host $host;
     }