feat(jobber): migrate to temporal

[dargmuesli]

Replaces jobber with a self-hosted Temporal: the workflow server, its ui, and a worker built from maevsi/temporal.

All jobber service definitions, configurations, and notification sink scripts are gone from both environments.
The S3 bucket secret keeps its jobber-aws-bucket name on purpose, because dargstack generated that value, the value is the name of the bucket that already holds production's backups, and renaming it would generate a new word pointing at a bucket that does not exist.

Temporal keeps its state in the existing postgres, under two new database roles that sqitch owns.
The worker gets a role of its own for the outbox purge workflow, which stays disabled until the outbox table lands in sqitch.
A small entrypoint wrapper reads the mounted secret files, since the auto-setup image has no support for Docker's _FILE-suffixed secret convention.

Prometheus scrapes both the server and the worker.
The workflow failure alert is written up in docs/grafana.md instead of being provisioned from a file, matching how the rest of Grafana's configuration has been handled since it moved into Grafana's own database.

Neither the Temporal ui nor the Redpanda console has a login of its own, and both can do damage: terminating or signalling workflows, deleting topics.
The reverse proxy now puts basic authentication in front of both in production, built from dargstack's basic_auth secret type, which generates a username, a password, and the bcrypt htpasswd line joining them.
Only the hash is mounted into the reverse proxy; both halves keep a file of their own so the generated credential stays readable with dargstack secret show.
That secret type arrived in dargstack 4.17.0, so the compatibility range moves accordingly.

Along the way, the production reverse proxy override replaced its base secrets list rather than appending to it, which silently dropped every secret the development definition mounted.
It appends now.

Merged with main after the multi-node change landed.
temporal bind-mounts its entrypoint from configurations/ and temporal-worker mounts the database backup volume, so both are pinned to the storage node and docs/multi-node.md lists them in jobber's place.
The worker's S3 credentials follow the same change main made for tusd, templating from the minio root secrets rather than carrying an insecure default.