[ci skip] iSCSI migration, healthcheck fixes, health probes, etcd backup

- Migrate MySQL/PostgreSQL storage from local-path to iscsi-truenas
- Add democratic-csi iSCSI driver module for TrueNAS
- Add open-iscsi to cloud-init VM template
- Fix Shlink health probe path (/api/v3 -> /rest/v3 for Shlink 5.0)
- Fix etcd backup: use etcd 3.5.21-0 (3.6.x is distroless, no /bin/sh)
- Fix cluster healthcheck CronJob: always exit 0 to prevent circular
  JobFailed alerts (reporting via Slack, not exit codes)
- Fix Uptime Kuma nested list handling in cluster-health.sh
- Add health probes to: audiobookshelf, immich ML, ntfy, headscale,
  uptime-kuma, vaultwarden, rybbit (clickhouse + server + client),
  shlink, shlink-web
- Add iSCSI storage documentation to CLAUDE.md

stacks/platform/main.tf

@@ -123,6 +123,16 @@ variable "webhook_handler_git_token" { type = string }
 variable "technitium_username" { type = string }
 variable "technitium_password" { type = string }
 
+# --- iscsi-csi ---
+variable "truenas_api_key" {
+  type      = string
+  sensitive = true
+}
+variable "truenas_ssh_private_key" {
+  type      = string
+  sensitive = true
+}
+
 # =============================================================================
 # Module Calls
 # =============================================================================
@@ -318,6 +328,17 @@ module "nfs-csi" {
   nfs_server = var.nfs_server
 }
 
+# -----------------------------------------------------------------------------
+# iSCSI CSI — democratic-csi for TrueNAS iSCSI (database storage)
+# -----------------------------------------------------------------------------
+module "iscsi-csi" {
+  source                 = "./modules/iscsi-csi"
+  tier                   = local.tiers.cluster
+  truenas_host           = var.nfs_server # Same TrueNAS host
+  truenas_api_key        = var.truenas_api_key
+  truenas_ssh_private_key = var.truenas_ssh_private_key
+}
+
 # -----------------------------------------------------------------------------
 # CNPG — CloudNativePG Operator + local-path-provisioner for database storage
 # -----------------------------------------------------------------------------