chore: upgrade impress to v6.0.2 (yhub collaboration), nginx to 1.31.8, docspec 1.21.4

README.md

@@ -19,7 +19,6 @@
 ## Quick start
 
 * `abra app new lasuite-docs --secrets`
-* Insert the two RSA keys, which abra cannot generate (see below)
 * `abra app config <app-name>`
 * `abra app deploy <app-name>`
 
@@ -30,21 +29,13 @@ You should then be able to visit the landing page of your app, but not yet to lo
 
 ## RSA keys
 
-Since v6, the backend and the collaboration server (`yhub`) authenticate each other with signed tokens. Each needs its own RSA private key, never the same one:
-
-```
-openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out jwt.pem
-openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out yhub-jwt.pem
-abra app secret insert <app-name> jwt_pk v1 jwt.pem -f
-abra app secret insert <app-name> yhub_jwt_pk v1 yhub-jwt.pem -f
-rm jwt.pem yhub-jwt.pem
-```
+Since v6, the backend and the collaboration server (`yhub`) authenticate each other with signed tokens. Each needs its own RSA private key, never the same one. The recipe generates both automatically on first deploy into the `jwt_keys` volume (the `jwt-keys` service, using the yhub image's Node crypto) and reuses them on later deploys. They are not Swarm secrets because abra cannot generate PEM keys and Swarm secrets must exist before the stack is deployed.
 
 ## Upgrading from v5 to v6
 
 v6 replaces the collaboration server. Document content moves from the minio bucket to the new `yhub` service, which stores it in its own `yhub` database. If you skip the migration, every existing document opens **empty**. See [UPGRADE.md](https://github.com/suitenumerique/docs/blob/main/UPGRADE.md) upstream for details.
 
-1. Insert the two RSA keys (see "RSA keys" above). The `collab_ss` secret is no longer used.
+1. The `collab_ss` secret is no longer used. The two RSA keys are generated automatically on first deploy (see "RSA keys" above).
 2. Leave `SOFT_MIGRATION` at its default (`true`) and deploy. The `yhub` schema is created on startup. A document is copied to yhub the first time someone opens it.
 3. Copy all remaining documents: `abra app cmd <app-name> backend migrate_documents`. You can pass arguments, e.g. `abra app cmd <app-name> backend migrate_documents -- --dry-run`. Re-run it with `--retry-failed` if some documents failed.
 4. Only after that, you may set `SOFT_MIGRATION=false`. Keep the minio bucket and its object versions: they hold the document history from before v6.