papra: add required AUTH_SECRET (app refuses to boot without it)

papra was NOT version-bumped by this campaign -- it crash-looped at its existing
26.6.1-rootless pin, so this is a PRE-EXISTING catalog defect: papra has never
been deployable from this template.

  Invalid configuration: In production, the auth secret must not be the default
  one. Please set a secure auth secret using the AUTH_SECRET environment
  variable.

Added as a generated hex:32 secret and marked data_key: true -- it signs
sessions, so regenerating it on restore would invalidate every login.

Campaign 7 catalog sweep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

templates/n8n/.felhom.yml

@@ -11,8 +11,8 @@ slug: "n8n"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
-  mem_request: "150M"
-  mem_limit: "512M"
+  mem_request: "512M"
+  mem_limit: "1536M"
   pi_compatible: false
   needs_hdd: false
 

templates/n8n/docker-compose.yml

@@ -25,7 +25,7 @@ services:
     deploy:
       resources:
         limits:
-          memory: 512M
+          memory: 1536M
     healthcheck:
       test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:5678/healthz"]
       interval: 30s

templates/outline/docker-compose.yml

@@ -24,6 +24,10 @@ services:
       - SECRET_KEY=${SECRET_KEY}
       - UTILS_SECRET=${UTILS_SECRET}
       - DATABASE_URL=postgres://outline:${DB_PASSWORD}@outline-postgres:5432/outline
+      # Az Outline 1.x alapértelmezésben SSL-t vár a Postgrestől. A stackben futó
+      # sidecar Postgres nem beszél SSL-t (belső hálózat), ezért enélkül az app
+      # indulási hurokba kerül: "The server does not support SSL connections".
+      - PGSSLMODE=disable
       - REDIS_URL=redis://outline-redis:6379
       - URL=https://${SUBDOMAIN}.${DOMAIN}
       - PORT=3000

templates/papra/.felhom.yml

@@ -30,6 +30,17 @@ deploy_fields:
     default: "papra"
     required: true
     locked_after_deploy: true
+
+  - env_var: AUTH_SECRET
+    label: "Munkamenet-aláíró kulcs"
+    type: secret
+    generate: "hex:32"
+    locked_after_deploy: true
+    # A Papra éles módban ELUTASÍTJA az indulást, ha ez az alapértelmezett érték
+    # marad ("the auth secret must not be the default one"), ezért kötelező.
+    # Ez írja alá a munkameneteket: ha újragenerálódik, minden bejelentkezés
+    # érvénytelenné válik, ezért visszaállításkor a régi kulcsot kell megtartani.
+    data_key: true
     description: "Az alkalmazás aldomainje"
 
 # --- App info (info page content) ---

templates/papra/docker-compose.yml

@@ -14,6 +14,7 @@ services:
     environment:
       - TZ=Europe/Budapest
       - APP_BASE_URL=https://${SUBDOMAIN}.${DOMAIN}
+      - AUTH_SECRET=${AUTH_SECRET}
     volumes:
       - papra_data:/app/data
     networks: