[ci skip] iSCSI migration, healthcheck fixes, health probes, etcd backup

- Migrate MySQL/PostgreSQL storage from local-path to iscsi-truenas
- Add democratic-csi iSCSI driver module for TrueNAS
- Add open-iscsi to cloud-init VM template
- Fix Shlink health probe path (/api/v3 -> /rest/v3 for Shlink 5.0)
- Fix etcd backup: use etcd 3.5.21-0 (3.6.x is distroless, no /bin/sh)
- Fix cluster healthcheck CronJob: always exit 0 to prevent circular
  JobFailed alerts (reporting via Slack, not exit codes)
- Fix Uptime Kuma nested list handling in cluster-health.sh
- Add health probes to: audiobookshelf, immich ML, ntfy, headscale,
  uptime-kuma, vaultwarden, rybbit (clickhouse + server + client),
  shlink, shlink-web
- Add iSCSI storage documentation to CLAUDE.md

stacks/rybbit/main.tf

@@ -49,6 +49,9 @@ resource "kubernetes_deployment" "clickhouse" {
   }
   spec {
     replicas = 1
+    strategy {
+      type = "Recreate"
+    }
     selector {
       match_labels = {
         app = "clickhouse"
@@ -77,6 +80,26 @@ resource "kubernetes_deployment" "clickhouse" {
             protocol       = "TCP"
             container_port = 8123
           }
+          liveness_probe {
+            http_get {
+              path = "/ping"
+              port = 8123
+            }
+            initial_delay_seconds = 15
+            period_seconds        = 30
+            timeout_seconds       = 5
+            failure_threshold     = 5
+          }
+          readiness_probe {
+            http_get {
+              path = "/ping"
+              port = 8123
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 30
+            timeout_seconds       = 5
+            failure_threshold     = 3
+          }
           volume_mount {
             name       = "data"
             mount_path = "/var/lib/clickhouse"
@@ -133,7 +156,7 @@ resource "kubernetes_cron_job_v1" "clickhouse_truncate_logs" {
     namespace = kubernetes_namespace.rybbit.metadata[0].name
   }
   spec {
-    schedule = "0 */6 * * *"
+    schedule                      = "0 */6 * * *"
     successful_jobs_history_limit = 1
     failed_jobs_history_limit     = 1
     job_template {
@@ -252,6 +275,26 @@ resource "kubernetes_deployment" "rybbit" {
           port {
             container_port = 3001
           }
+          liveness_probe {
+            http_get {
+              path = "/api/health"
+              port = 3001
+            }
+            initial_delay_seconds = 15
+            period_seconds        = 30
+            timeout_seconds       = 5
+            failure_threshold     = 5
+          }
+          readiness_probe {
+            http_get {
+              path = "/api/health"
+              port = 3001
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 30
+            timeout_seconds       = 5
+            failure_threshold     = 3
+          }
           resources {
             requests = {
               cpu    = "25m"
@@ -328,6 +371,26 @@ resource "kubernetes_deployment" "rybbit-client" {
             protocol       = "TCP"
             container_port = 3002
           }
+          liveness_probe {
+            http_get {
+              path = "/"
+              port = 3002
+            }
+            initial_delay_seconds = 15
+            period_seconds        = 30
+            timeout_seconds       = 5
+            failure_threshold     = 5
+          }
+          readiness_probe {
+            http_get {
+              path = "/"
+              port = 3002
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 30
+            timeout_seconds       = 5
+            failure_threshold     = 3
+          }
           resources {
             requests = {
               cpu    = "10m"