Docker stack: make ffmpeg executable, raise the PHP-FPM pool (#5746)

Composer installs plugins/ffmpeg/ffmpeg.exe from a "file" dist, which
never sets the executable bit, so in the docker-compose stack every
video poster and MP4 conversion failed with "Permission denied".
relocate-ffmpeg now runs chmod 0755 after the move. The command also
runs when the file was not re-downloaded, so the next composer install
fixes an existing 0644 binary.

The php:8.3-fpm pool stops at 5 workers. image_transcoder.php holds a
worker while it downloads the original through the site URL, and that
request needs a second worker, so 5 parallel thumbnail requests
deadlocked until nginx's 60 s timeout. A pool override with 32 workers
is now bind-mounted next to php.ini.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

composer.json

@@ -125,6 +125,7 @@
         ],
         "relocate-ffmpeg": [
             "test -f ./plugins/ffmpeg/ffmpeg/ffmpeg-linux-x64 && mv ./plugins/ffmpeg/ffmpeg/ffmpeg-linux-x64 ./plugins/ffmpeg/ffmpeg.exe && rm -rf ./plugins/ffmpeg/ffmpeg || true",
+            "test -f ./plugins/ffmpeg/ffmpeg.exe && chmod 0755 ./plugins/ffmpeg/ffmpeg.exe || true",
             "grep -Fq \"this->headers['Content-MD5']\" plugins/tpyo/amazon-s3-php-class/S3.php || patch -p1 --batch < patches/plugins_tpyo_amazon-s3-php-class.txt"
         ],
         "test": "phpunit -c tests/phpunit.xml",

docker-compose.yml

@@ -19,6 +19,7 @@ services:
             dockerfile: scripts/docker-compose/PHP.Dockerfile
         volumes:
             - ./scripts/docker-compose/php.ini:/usr/local/etc/php/php.ini
+            - ./scripts/docker-compose/php-fpm-pool.conf:/usr/local/etc/php-fpm.d/zz-una.conf
             - ./:/opt/una
         extra_hosts:
             - "host.docker.internal:host-gateway"

scripts/docker-compose/php-fpm-pool.conf

@@ -0,0 +1,10 @@
+; Loaded after the image's www.conf, which caps the pool at 5 workers.
+; image_transcoder.php keeps its worker while it downloads the original file
+; through the site URL, and that download needs a second worker. With 5 workers,
+; 5 parallel thumbnail requests took them all and hung until nginx returned 504.
+[www]
+pm = dynamic
+pm.max_children = 32
+pm.start_servers = 4
+pm.min_spare_servers = 2
+pm.max_spare_servers = 8