Upgrade to drive v0.25.3, replace MinIO with RustFS

- use rustfs instead of minio and provide migration script
- Schedule clean_pending_items/purge_deleted_items with celery beat
- Give celery workers the S3 access key secret
- Collabora admin access needs setting a password

Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md):

 #LLM_vibe
 #LLM_model Claude Opus 5.5

- [x] I take full responsibility for this code
- [x] I understand every line of this code
- [x] I tested this code thoroughly on my own computer / servers
- [x] None of the commit messages were created using LLMs
- [x] I will participate in any discussion on my own and will not use an LLM for the discussion

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

compose.minio-migration.yml

@@ -0,0 +1,47 @@
+---
+# Temporary overlay to migrate the media files from the old MinIO service
+# (recipe versions up to 0.13.x) to RustFS. See README "Migrating from MinIO".
+services:
+  minio:
+    image: bitnamilegacy/minio:2025.7.23-debian-12-r5
+    user: root
+    environment:
+      MINIO_ROOT_USER_FILE: /run/secrets/minio_ru
+      MINIO_ROOT_PASSWORD_FILE: /run/secrets/minio_rp
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 5s
+      timeout: 20s
+      retries: 60
+    networks:
+      - backend
+    volumes:
+      - minio:/bitnami/minio/data
+    secrets:
+      - minio_rp
+      - minio_ru
+
+  backend:
+    secrets:
+      - minio_rp
+      - minio_ru
+    configs:
+      - source: migrate_from_minio
+        target: /migrate-from-minio.sh
+        mode: 0555
+
+volumes:
+  minio:
+
+configs:
+  migrate_from_minio:
+    name: ${STACK_NAME}_migrate_from_minio_${MIGRATE_FROM_MINIO_VERSION}
+    file: migrate-from-minio.sh
+
+secrets:
+  minio_rp:
+    external: true
+    name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION}
+  minio_ru:
+    external: true
+    name: ${STACK_NAME}_minio_ru_${SECRET_MINIO_RU_VERSION}