Discourse: move from Bitnami chart to launcher-built image

The Bitnami chart and images stop at 3.5.0. Run Discourse 2026.10.0 from
an image built with the official launcher, on PostgreSQL 18, reusing the
existing uploads volume, Redis and secrets.

Update the Dex sign-in step for the new image paths, drop the removed
LDAP setting, and keep chat off now that it is bundled in core. The image
adds a real-IP rule so visitors are not all rate limited as the ingress.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

files/discourse/postgres18.yaml

@@ -0,0 +1,73 @@
+# PostgreSQL 18 with pgvector for Discourse. Runs alongside the old Bitnami
+# PostgreSQL 17 StatefulSet, whose volume stays untouched for rollback.
+apiVersion: v1
+kind: Service
+metadata:
+  name: discourse-postgres18
+  namespace: discourse
+  labels:
+    app.kubernetes.io/name: discourse-postgres18
+spec:
+  clusterIP: None
+  selector:
+    app.kubernetes.io/name: discourse-postgres18
+  ports:
+    - name: postgresql
+      port: 5432
+      targetPort: postgresql
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: discourse-postgres18
+  namespace: discourse
+  labels:
+    app.kubernetes.io/name: discourse-postgres18
+spec:
+  serviceName: discourse-postgres18
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: discourse-postgres18
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: discourse-postgres18
+    spec:
+      containers:
+        - name: postgresql
+          image: pgvector/pgvector:pg18
+          ports:
+            - name: postgresql
+              containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              value: postgres
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-postgresql
+                  key: postgres-password
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
+            periodSeconds: 10
+            failureThreshold: 6
+          livenessProbe:
+            exec:
+              command: ["pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            failureThreshold: 6
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: nfs-client
+        resources:
+          requests:
+            storage: 2Ti