Upgrade to drive v0.25.3, replace MinIO with RustFS

- use rustfs instead of minio and provide migration script
- Schedule clean_pending_items/purge_deleted_items with celery beat
- Give celery workers the S3 access key secret
- Collabora admin access needs setting a password

Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md):

 #LLM_vibe
 #LLM_model Claude Opus 5.5

- [x] I take full responsibility for this code
- [x] I understand every line of this code
- [x] I tested this code thoroughly on my own computer / servers
- [x] None of the commit messages were created using LLMs
- [x] I will participate in any discussion on my own and will not use an LLM for the discussion

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

nginx.conf.tmpl

@@ -56,9 +56,9 @@ server {
         proxy_set_header X-Amz-Date $authDate;
         proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
 
-        # Get resource from Minio
-        proxy_pass http://minio:9000/drive-media-storage/;
-        proxy_set_header Host minio:9000;
+        # Get resource from the RustFS object storage
+        proxy_pass http://rustfs:9000/drive-media-storage/;
+        proxy_set_header Host rustfs:9000;
     }
 
     # Proxy auth for media-preview
@@ -74,9 +74,9 @@ server {
         proxy_set_header X-Amz-Date $authDate;
         proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
 
-        # Get resource from Minio
-        proxy_pass http://minio:9000/drive-media-storage/;
-        proxy_set_header Host minio:9000;
+        # Get resource from the RustFS object storage
+        proxy_pass http://rustfs:9000/drive-media-storage/;
+        proxy_set_header Host rustfs:9000;
     }
 
     location /media-auth {