Upgrade HeyForm from v0.1.0 to v3.0.5

v0.1.0 (Feb 2025) has dozens of published security advisories fixed in
v3. Tested against a copy of the database first; forms load unchanged.

v3 listens on 9157, keeps uploads under packages/server, and uses Redis 8
commands, so KeyDB is replaced by redis:8-alpine. The homepage URL is now
https (v3's CORS allowlist is built from it), Caddy is the trusted proxy,
public sign-up is off, and integration credentials get their own key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/README.md

@@ -48,7 +48,7 @@ Tags: each category file has a category tag, each service its own tag.
 | `paperlessngx` | Paperless-ngx | Version pinned by `paperless_version` in `group_vars/docker/services.yml`; read the release notes before bumping. Redis, Gotenberg, Tika (pinned to the versions Paperless ships with). Pocket ID through django-allauth (`paperlessngx.env.j2`). Rejects duplicate documents. Daily S3 backup of the data and media volumes. |
 | `baikal` | Baikal | CalDAV/CardDAV. Caddy redirects the `.well-known` paths. |
 | `syncthing` | Syncthing | Ports on the Tailscale IP only. |
-| `heyform` | HeyForm | MongoDB (Percona) and KeyDB. On `forms.nerder.land`. |
+| `heyform` | HeyForm v3 | Pinned version. MongoDB 4.4 (Percona, as upstream) and Redis 8 (v3 needs it). Port 9157. Public sign-up is off; people join through workspace invitations. On `forms.nerder.land`. |
 | `dawarich` | Dawarich | App, Sidekiq, PostGIS, Redis. Based on the upstream production compose file. |
 | `obsidian-livesync` | CouchDB for Obsidian LiveSync | Port 5984 on the Tailscale IP only. Has a restart handler. |
 | `gokapi` | Gokapi | Pocket ID login. `config.json` is only written on a fresh install, because Gokapi rewrites it on upgrade. To change it, delete `/opt/stacks/gokapi/config/config.json` and redeploy. |