fix: [carbone-ee] enable Studio and template management

The charm had no ``hooks/init``, so Carbone started in its default
stateless mode: no Studio, no template management, and ``CARBONE_BIND``
defaulting to ``127.0.0.1`` (unreachable behind the web-proxy).

Add ``hooks/init`` to:
- bind on ``0.0.0.0`` so the ``web-proxy`` can reach the service ;
- serve the Studio and ``/carbone-studio.js`` (``CARBONE_STUDIO``) ;
- enable stateful template management (``CARBONE_TEMPLATE_MANAGEMENT``):
  stable 64-bit template IDs, versioning and the ``/template`` endpoints ;
- align the datastore/configstore ownership on the unprivileged
  ``carbone`` image user, otherwise the container crash-loops with
  ``EACCES`` on ``/app/config/config.json``.

Persist ``/app/config`` as a ``config-resources`` and set a
``docker-compose.stop_grace_period`` of 200s: Carbone flushes its
template metadata on graceful shutdown, and Docker's 10s default would
SIGKILL it and lose templates on redeploy.  Flush metadata every
5 minutes to shrink the hard-crash window.

Bump the image to ``full-5.15.1`` and add a local ``basic-deploy`` test.

Verified locally: ``/status`` 200, ``/carbone-studio.js`` 200,
``GET /templates`` 200, template upload with versioning plus render
from the stable template ID, and metadata survival across a container
recreation.

carbone/README.org

@@ -1,17 +1,66 @@
 # -*- ispell-local-dictionary: "english" -*-
 
-* Info 
+* Info
 
 From: Carbone https://hub.docker.com/r/carbone/carbone-ee#running-carbone-community-edition-forever-free
 
-## Usage : 
+Upstream documentation:
+- On-premise configuration: https://carbone.io/documentation/developer/on-premise-installation/configuration.html
+- Template management: https://carbone.io/documentation/developer/on-premise-installation/template-management.html
+- Studio Web Component: https://carbone.io/documentation/developer/embedding/studio-web-component.html
+
+* What this charm enables
+
+By default Carbone starts in the *stateless* mode: it only renders the
+template sent with each request, exposes no Studio and keeps no template
+metadata.  The =init= hook turns it into the *stateful* service, which is
+what the charm is meant to provide:
+
+- =CARBONE_STUDIO=true= serves the Studio web interface and the
+  =/carbone-studio.js= Web Component.
+- =CARBONE_TEMPLATE_MANAGEMENT=true= enables stable 64-bit template IDs,
+  versioning, the =GET/POST/PATCH /template= endpoints and the
+  =embedded-versioning= Studio mode.
+- =CARBONE_BIND=0.0.0.0= makes Carbone listen on all interfaces so the
+  =web-proxy= can reach it (the upstream default is =127.0.0.1=).
+
+* Usage
 
 ex :
 
-```
+#+begin_src yaml
 carbone:
   relations:
     web-proxy:
       frontend:
         domain: carbone.dev1.elabore.coop
-```
+#+end_src
+
+* Persistence
+
+| Path            | Resource type    | Content                                              |
+|-----------------+------------------+------------------------------------------------------|
+| =/app/template= | =data-resources= | Templates and the metadata store (metadata.db)       |
+| =/app/config=   | =config-resources= | Optional license, authentication public key (key.pub) |
+
+Templates and their versioning metadata both live under =/app/template=,
+so they survive redeploys and are covered by the =backup= relation.
+
+* Enterprise license
+
+Carbone runs fine without a license (Community Edition, forever free).
+Advanced features (dynamic images/colors, barcodes, charts, HTML
+aggregation, PDF operations, ...) require an Enterprise license.
+
+To enable it, drop your =*.carbone-license= file into the config store
+(=/app/config= on the host side, i.e.
+=$SERVICE_CONFIGSTORE/app/config=) and redeploy the service.
+
+* API authentication
+
+Authentication is *disabled by default*: the API is reachable as soon as
+the service is up, which is the expected setup behind the =web-proxy=.
+If you ever need an API key (JWT), enable =CARBONE_AUTHENTICATION=true=,
+generate an EC keypair with =generate-keys=, expose the public key as
+=/app/config/key.pub= and generate a token with =generate-token=.  See
+the upstream "Deploy with Docker" documentation for the exact commands.