Merge upstream main into v6 upgrade branch

Keep the runtime jwt-keys sidecar (cc-ci cannot pre-insert PEM secrets) and
the Rust docspec image on top of upstream v6.0.4.

compose.yml

@@ -127,7 +127,7 @@ services:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.4.4+v5.6.1"
+        - "coop-cloud.${STACK_NAME}.version=1.0.1+v6.0.4"
     user: "${DOCKER_USER:-1000}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080"]
@@ -231,7 +231,7 @@ services:
 
   # Valkey of yhub: holds updates not yet persisted to postgres, so it is a store, not a cache
   yhub-valkey:
-    image: valkey/valkey:8.1.10-alpine
+    image: valkey/valkey:8.1.11-alpine
     command: ["valkey-server", "--maxmemory-policy", "volatile-lru", "--appendonly", "yes", "--appendfsync", "everysec"]
     healthcheck:
       test: ["CMD", "valkey-cli", "ping"]

release/1.0.0+v6.0.3

@@ -0,0 +1,22 @@
+⚠️ Major upgrade to Docs v6: the collaboration server is replaced by the new `yhub`
+service, and existing documents have to be migrated to it, or they open EMPTY.
+
+Before deploying, generate and insert two RSA keys:
+
+  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out jwt.pem
+  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out yhub-jwt.pem
+  abra app secret insert <app-name> jwt_pk v1 jwt.pem -f
+  abra app secret insert <app-name> yhub_jwt_pk v1 yhub-jwt.pem -f
+
+and add to your app config:
+
+  SECRET_JWT_PK_VERSION=v1 # generate=false
+  SECRET_YHUB_JWT_PK_VERSION=v1 # generate=false
+
+`SECRET_COLLAB_SS_VERSION` and the `collab_ss` secret are no longer used.
+
+After deploying (SOFT_MIGRATION is on by default), migrate all documents:
+
+  abra app cmd <app-name> backend migrate_documents
+
+Only then may you set SOFT_MIGRATION=false. See the README for details.