feat(lasuite): deploy La Suite Docs (impress)

Adds the impress Helm chart (suitenumerique/docs, v4.5.0) to the lasuite
namespace with full Pingora routing, VSO secrets, and local overlay
resource tuning.

Routing (pingora-config.yaml):
- docs.* frontend -> docs-frontend:80 (nginx, static Next.js export)
- /api/* and /admin/* -> docs-backend:80 (Django/uvicorn)
- /collaboration/ws/* -> docs-y-provider:4444 (Hocuspocus WebSocket)
- integration.* -> integration:80 (La Gaufre hub, same file)

Secrets (vault-secrets.yaml):
- VaultDynamicSecret docs-db-credentials (DB engine, static role)
- VaultStaticSecret docs-django-secret (DJANGO_SECRET_KEY)
- VaultStaticSecret docs-collaboration-secret (y-provider shared secret)

OIDC client (oidc-clients.yaml):
- Fix redirect_uri from /oidc/callback/ to /api/v1.0/callback/ -- impress
  mounts all OIDC URLs under api/{API_VERSION}/ via lasuite.oidc_login,
  same pattern as people.

Local overlay (values-resources.yaml):
- docs-backend: 512Mi limit, WEB_CONCURRENCY=2 (4 uvicorn workers
  exceeded 384Mi at startup on the arm64 Lima VM)
- docs-celery-worker: 384Mi limit, CELERY_WORKER_CONCURRENCY=2
- docs-y-provider: 256Mi limit
- seaweedfs-filer: raised from 256Mi to 512Mi (OOMKilled during 188MB
  multipart S3 upload of impress-y-provider image layer)

Local overlay (kustomization.yaml):
- Image mirrors for impress-backend, impress-frontend, impress-y-provider
  (amd64-only images retagged to Gitea via cmd_mirror before deploy)

overlays/local/kustomization.yaml

@@ -36,6 +36,14 @@ images:
   - name: lasuite/people-frontend
     newName: src.DOMAIN_SUFFIX/studio/people-frontend
 
+  # amd64-only impress (Docs) images — same mirror pattern.
+  - name: lasuite/impress-backend
+    newName: src.DOMAIN_SUFFIX/studio/impress-backend
+  - name: lasuite/impress-frontend
+    newName: src.DOMAIN_SUFFIX/studio/impress-frontend
+  - name: lasuite/impress-y-provider
+    newName: src.DOMAIN_SUFFIX/studio/impress-y-provider
+
 patches:
   # Disable SSL verification for OIDC server-side calls — mkcert CA not trusted in pods
   - path: patch-oidc-verify-ssl.yaml

overlays/local/values-resources.yaml

@@ -98,7 +98,9 @@ spec:
         - name: filer
           resources:
             limits:
-              memory: 256Mi
+              memory: 512Mi
+            requests:
+              memory: 128Mi
 
 ---
 apiVersion: apps/v1
@@ -173,3 +175,83 @@ metadata:
   namespace: lasuite
 spec:
   replicas: 1
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docs-celery-worker
+  namespace: lasuite
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: docs
+          env:
+            # Celery workers: 2 concurrent workers fits within local memory budget.
+            - name: CELERY_WORKER_CONCURRENCY
+              value: "2"
+          resources:
+            limits:
+              memory: 384Mi
+            requests:
+              memory: 128Mi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docs-backend
+  namespace: lasuite
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: docs
+          env:
+            # 2 uvicorn workers instead of the default 4 to stay within local memory budget.
+            # Each worker loads the full Django+impress app (~150 MB), so 4 workers
+            # pushed peak RSS above 384 Mi and triggered OOMKill at startup.
+            - name: WEB_CONCURRENCY
+              value: "2"
+          resources:
+            limits:
+              memory: 512Mi
+            requests:
+              memory: 192Mi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docs-frontend
+  namespace: lasuite
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: docs
+          resources:
+            limits:
+              memory: 128Mi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docs-y-provider
+  namespace: lasuite
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: docs
+          resources:
+            limits:
+              memory: 256Mi
+            requests:
+              memory: 64Mi