Upgrade to drive v0.25.3, replace MinIO with RustFS

- use rustfs instead of minio and provide migration script
- Schedule clean_pending_items/purge_deleted_items with celery beat
- Give celery workers the S3 access key secret
- Collabora admin access needs setting a password

Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md):

 #LLM_vibe
 #LLM_model Claude Opus 5.5

- [x] I take full responsibility for this code
- [x] I understand every line of this code
- [x] I tested this code thoroughly on my own computer / servers
- [x] None of the commit messages were created using LLMs
- [x] I will participate in any discussion on my own and will not use an LLM for the discussion

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

release/next

@@ -0,0 +1,27 @@
+Upgrade to drive v0.25.3.
+
+**Breaking change:** following upstream, the S3 object storage changed from MinIO (`bitnamilegacy/minio`, unmaintained) to RustFS (`rustfs/rustfs`). RustFS cannot read the MinIO data, so existing media files must be copied once:
+
+```
+abra app config <app-domain>   # add:
+                               #   RUSTFS_DOMAIN="${MINIO_DOMAIN}"
+                               #   SECRET_RUSTFS_RP_VERSION=v1
+                               #   SECRET_RUSTFS_RU_VERSION=v1
+                               #   COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
+abra app secret generate <app-domain> rustfs_ru v1
+abra app secret generate <app-domain> rustfs_rp v1
+abra app upgrade <app-domain>
+abra app cmd <app-domain> backend migrate_from_minio
+abra app config <app-domain>   # remove the COMPOSE_FILE line
+abra app deploy <app-domain> --force
+```
+
+See README "Migrating from MinIO" for details. RustFS uses the new `rustfs_ru`/`rustfs_rp` secrets and `RUSTFS_DOMAIN`. The old `minio_ru`/`minio_rp` secrets and `MINIO_DOMAIN` are only needed during the migration.
+
+**Breaking change:** the Collabora image is distroless and cannot read Docker secrets, so the `collabora_p` secret is no longer used. The admin panel is unusable until you set `COLLABORA_ADMIN_PASSWORD` with `abra app config <app-domain>`. The password is passed as a plain environment variable, visible in `docker service inspect`. Remove `SECRET_COLLABORA_P_VERSION` from your config, and optionally the secret with `abra app secret remove <app-domain> collabora_p`. See README "Configure the Collabora Admin Panel".
+
+Other changes:
+- The S3 bucket is now created by the backend on startup (`abra app cmd <app-domain> backend s3_initialize`), the `minio_initialize` command is gone.
+- Maintenance commands `clean_pending_items` (daily 0:30) and `purge_deleted_items` (daily 0:45) are now scheduled by celery beat. Configure with `CLEAN_PENDING_ITEMS_SCHEDULE` / `PURGE_DELETED_ITEMS_SCHEDULE`. Note that this permanently purges items deleted from the trash after the upstream grace periods (30 + 7 days).
+- New `SDK_ENABLED` setting (default `false`) for the SDK picker used by other La Suite apps.
+- The celery workers now get the S3 access key secret too.