feat(lasuite): deploy La Suite Docs (impress)

Adds the impress Helm chart (suitenumerique/docs, v4.5.0) to the lasuite
namespace with full Pingora routing, VSO secrets, and local overlay
resource tuning.

Routing (pingora-config.yaml):
- docs.* frontend -> docs-frontend:80 (nginx, static Next.js export)
- /api/* and /admin/* -> docs-backend:80 (Django/uvicorn)
- /collaboration/ws/* -> docs-y-provider:4444 (Hocuspocus WebSocket)
- integration.* -> integration:80 (La Gaufre hub, same file)

Secrets (vault-secrets.yaml):
- VaultDynamicSecret docs-db-credentials (DB engine, static role)
- VaultStaticSecret docs-django-secret (DJANGO_SECRET_KEY)
- VaultStaticSecret docs-collaboration-secret (y-provider shared secret)

OIDC client (oidc-clients.yaml):
- Fix redirect_uri from /oidc/callback/ to /api/v1.0/callback/ -- impress
  mounts all OIDC URLs under api/{API_VERSION}/ via lasuite.oidc_login,
  same pattern as people.

Local overlay (values-resources.yaml):
- docs-backend: 512Mi limit, WEB_CONCURRENCY=2 (4 uvicorn workers
  exceeded 384Mi at startup on the arm64 Lima VM)
- docs-celery-worker: 384Mi limit, CELERY_WORKER_CONCURRENCY=2
- docs-y-provider: 256Mi limit
- seaweedfs-filer: raised from 256Mi to 512Mi (OOMKilled during 188MB
  multipart S3 upload of impress-y-provider image layer)

Local overlay (kustomization.yaml):
- Image mirrors for impress-backend, impress-frontend, impress-y-provider
  (amd64-only images retagged to Gitea via cmd_mirror before deploy)

base/ingress/pingora-config.yaml

@@ -39,8 +39,22 @@ data:
 
     [[routes]]
     host_prefix = "docs"
-    backend     = "http://docs.lasuite.svc.cluster.local:8000"
-    websocket   = true
+    backend     = "http://docs-frontend.lasuite.svc.cluster.local:80"
+
+      # API and admin go to the backend.
+      [[routes.paths]]
+      prefix  = "/api/"
+      backend = "http://docs-backend.lasuite.svc.cluster.local:80"
+
+      [[routes.paths]]
+      prefix  = "/admin/"
+      backend = "http://docs-backend.lasuite.svc.cluster.local:80"
+
+      # Real-time collaboration WebSocket (y-provider / Hocuspocus).
+      [[routes.paths]]
+      prefix    = "/collaboration/ws/"
+      backend   = "http://docs-y-provider.lasuite.svc.cluster.local:4444"
+      websocket = true
 
     [[routes]]
     host_prefix = "meet"
@@ -113,6 +127,10 @@ data:
     host_prefix = "admin"
     backend     = "http://kratos-admin-ui.ory.svc.cluster.local:3000"
 
+    [[routes]]
+    host_prefix = "integration"
+    backend     = "http://integration.lasuite.svc.cluster.local:80"
+
     [[routes]]
     host_prefix = "s3"
     backend     = "http://seaweedfs-filer.storage.svc.cluster.local:8333"