freshrss: Add deploy script, context & classifier examples

FreshRSS was the only service with just a config.yaml: no auto-update
script, no instance context, and no review examples. That left the
classifier with no few-shot context, so every release would fall back
to "manual", and the auto-updater had nothing to run. These files bring
it in line with the other services so patch & feature releases can be
applied automatically while real breaking changes (volume path moves,
new required env vars) still surface for manual review.

services/freshrss/review-examples/manual-2.txt

@@ -0,0 +1,19 @@
+action: manual
+reason: A new required environment variable FRESHRSS_INSTANCE_KEY must be set in docker-compose.yml, otherwise the container fails to start. The admin must generate a key and add the variable before upgrading.
+---
+> [!IMPORTANT]
+> Breaking change for all Docker users.
+
+Breaking changes:
+* A new environment variable `FRESHRSS_INSTANCE_KEY` is now required. It is used to sign session cookies and encrypt API tokens. If unset, the container will refuse to start. Generate a random 32-byte hex string and add it to your docker-compose.yml environment section.
+* The TRUSTED_PROXY environment variable has been renamed to FRESHRSS_TRUSTED_PROXY. The old name is no longer recognised.
+
+Migration steps:
+1. Generate an instance key: `openssl rand -hex 32`
+2. Add `FRESHRSS_INSTANCE_KEY: <key>` to the environment section of docker-compose.yml
+3. Rename `TRUSTED_PROXY` to `FRESHRSS_TRUSTED_PROXY` in your environment section.
+4. Pull the new image and restart.
+
+Features:
+* Add support for OAuth2 generic providers
+* Improved feed scraping