feat(supabase): add services and statefulset for database management

feat(synapse): update ingress to use traefik ingress class and bump version

feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress

feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration

fix(taiga): update liveness and readiness probes to use tcpSocket for health checks

fix(taiga): change PVC access mode to ReadWriteMany for media and static storage

feat(traefik): add icon and ignore rules for traefik service

docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments

feat(ushahidi): implement dedicated Redis deployment for Ushahidi

fix(vllm): update deployment strategy and readiness/liveness probes for improved stability

fix(writefreely): pin writefreely image version to v0.15.1 for consistency

docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior

docs/linuxserver.md

@@ -0,0 +1,44 @@
+# linuxserver.io / s6-overlay images
+
+## Security context
+
+Images using the s6-overlay init system (all linuxserver.io images) must run as root and need full capabilities to switch to their internal `abc` user. **Do not drop capabilities** — s6-overlay's user-switching will fail.
+
+```yaml
+spec:
+  template:
+    spec:
+      securityContext:        # pod level
+        runAsNonRoot: false
+        runAsUser: 0
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: app
+          securityContext:    # container level — only this field
+            readOnlyRootFilesystem: false
+```
+
+Do NOT set `allowPrivilegeEscalation: false` or `capabilities.drop: ALL` for these images.
+
+Suppress `WC-SC-POD` and `WC-SC-CTR` in `app.yaml`:
+
+```yaml
+ignoreRules:
+  - WC-SC-POD  # s6-overlay requires root
+  - WC-SC-CTR  # s6-overlay requires full capabilities
+```
+
+## PUID / PGID
+
+linuxserver.io images accept `PUID` and `PGID` env vars to set the internal `abc` user's UID/GID. Set them explicitly for consistent file ownership on PVCs:
+
+```yaml
+env:
+  - name: PUID
+    value: "1000"
+  - name: PGID
+    value: "1000"
+```
+
+**Affected apps**: BookStack, and any app using a linuxserver.io image.