Upgrade to drive v0.25.3, replace MinIO with RustFS

- use rustfs instead of minio and provide migration script
- Schedule clean_pending_items/purge_deleted_items with celery beat
- Give celery workers the S3 access key secret
- Collabora admin access needs setting a password

Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md):

 #LLM_vibe
 #LLM_model Claude Opus 5.5

- [x] I take full responsibility for this code
- [x] I understand every line of this code
- [x] I tested this code thoroughly on my own computer / servers
- [x] None of the commit messages were created using LLMs
- [x] I will participate in any discussion on my own and will not use an LLM for the discussion

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.sample

@@ -1,7 +1,8 @@
 TYPE=lasuite-drive
 
 DOMAIN=lasuite-drive.example.com
-MINIO_DOMAIN="minio.${DOMAIN}"
+# public domain of the RustFS object storage (S3)
+RUSTFS_DOMAIN="rustfs.${DOMAIN}"
 COLLABORA_DOMAIN="collabora.${DOMAIN}"
 ONLY_OFFICE_DOMAIN="onlyoffice.${DOMAIN}"
 
@@ -20,16 +21,14 @@ SECRET_DJANGO_SK_VERSION=v1
 SECRET_OIDC_RPCS_VERSION=v1
 # DJANGO_SUPERUSER_PASSWORD
 SECRET_DJANGO_SP_VERSION=v1
-# MINIO_ROOT_PASSWORD
-SECRET_MINIO_RP_VERSION=v1
-# MINIO_ROOT_USER
-SECRET_MINIO_RU_VERSION=v1
+# RUSTFS_SECRET_KEY
+SECRET_RUSTFS_RP_VERSION=v1
+# RUSTFS_ACCESS_KEY
+SECRET_RUSTFS_RU_VERSION=v1
 # POSTGRES_PASSWORD
 SECRET_POSTGRES_P_VERSION=v1
 # DJANGO_HOST_EMAIL_PASSWORD
 SECRET_EMAIL_PASS_VERSION=v1
-# COLLABORA_ADMIN_PASSWORD
-SECRET_COLLABORA_P_VERSION=v1
 
 ##############################################################################
 # EMAIL
@@ -78,8 +77,11 @@ LOGGING_LEVEL_LOGGERS_APP=INFO
 # COLLABORA ADMIN PANEL
 ##############################################################################
 # Username for the Collabora admin panel (https://COLLABORA_DOMAIN/browser/dist/admin/admin.html)
-# Password is managed via Docker secret 'collabora_p'
+# The distroless collabora image (>= 26.04) cannot read Docker secrets, so the
+# password is passed as a plain env var (visible in `docker service inspect`).
+# The admin panel is unusable while it is unset.
 #COLLABORA_ADMIN_USERNAME=admin
+#COLLABORA_ADMIN_PASSWORD=
 
 ##############################################################################
 # BACKUPS
@@ -87,6 +89,31 @@ LOGGING_LEVEL_LOGGERS_APP=INFO
 # Set to false to disable backup-bot labels (default: true)
 #ENABLE_BACKUPS=true
 
+##############################################################################
+# MAINTENANCE SCHEDULING
+##############################################################################
+# Celery Beat crontab (m h dom mon dow) followed by the command arguments
+# Clean up uploads that never finished (default: daily at 0:30)
+#CLEAN_PENDING_ITEMS_SCHEDULE="30 0 * * * --hours=48"
+# Permanently purge items deleted from the trash (default: daily at 0:45)
+#PURGE_DELETED_ITEMS_SCHEDULE="45 0 * * *"
+
+##############################################################################
+# SDK
+##############################################################################
+# Enable the SDK picker pages (/sdk) and relay API used by other La Suite apps
+#SDK_ENABLED=false
+
+##############################################################################
+# MINIO MIGRATION
+##############################################################################
+# Only needed once when upgrading from recipe versions using MinIO (<= 0.13.x),
+# see README "Migrating from MinIO"
+#COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
+# versions of the old MinIO secrets, keep them from your previous config
+#SECRET_MINIO_RP_VERSION=v1
+#SECRET_MINIO_RU_VERSION=v1
+
 ##############################################################################
 # WOPI SCHEDULING
 ##############################################################################