Upgrade peekskog to PHP 8.4 and MySQL 8.4, fix traefik headers

- wordpress:5.6.0-apache (PHP 7.4) -> wordpress:php8.4-apache
- mysql:5.7 -> mysql:8.4 with new datadir peekskog/db84 (imported
  from dump; old 5.7 datadir kept for rollback)
- Remove duplicate router middlewares label so www-redirect is applied
- Add upgrade-insecure-requests to CSP and a Permissions-Policy header
- Ignore local peek_backup/ directory

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -18,4 +18,5 @@ letsencrypt/
 letsencrypt_peek/
 zigbee2mqtt/configuration_*.yaml
 zigbee_home_2/database.db
-ha/config/.cache/**
+ha/config/.cache/**
+peek_backup/

docker-compose.per.yml

@@ -10,7 +10,7 @@ services:
         max-file: "3"
     depends_on:
       - db_peek
-    image: wordpress:5.6.0-apache
+    image: wordpress:php8.4-apache
     volumes:
       - ${DIR_LOCAL}/peekskog/wp:/var/www/html
       - ./wp/php.conf.ini:/usr/local/etc/php/conf.d/uploads.ini
@@ -34,8 +34,8 @@ services:
       - "traefik.http.routers.peek-secure.entrypoints=web-secure"
       - "traefik.http.routers.peek-secure.rule=Host(`peekskog.se`) || Host(`www.peekskog.se`)"
       - "traefik.http.routers.peek-secure.middlewares=www-redirect,peek-middle"
-      - "traefik.http.routers.peek-secure.middlewares=peek-middle"
-      - "traefik.http.middlewares.peek-middle.headers.contentSecurityPolicy=frame-ancestors 'self' peekskog.se"
+      - "traefik.http.middlewares.peek-middle.headers.contentSecurityPolicy=frame-ancestors 'self' peekskog.se; upgrade-insecure-requests"
+      - "traefik.http.middlewares.peek-middle.headers.permissionsPolicy=camera=(), microphone=(), geolocation=(), payment=(), usb=()"
       - "traefik.http.middlewares.peek-middle.headers.framedeny=true"
       - "traefik.http.middlewares.peek-middle.headers.stsSeconds=155520011"
       - "traefik.http.middlewares.peek-middle.headers.stsIncludeSubdomains=true"
@@ -52,14 +52,14 @@ services:
 
   db_peek:
     container_name: db_peek
-    image: mysql:5.7
+    image: mysql:8.4
     logging:
       driver: "json-file"
       options:
         max-size: "5m"
         max-file: "3"
     volumes:
-      - ${DIR_LOCAL}/peekskog/db:/var/lib/mysql
+      - ${DIR_LOCAL}/peekskog/db84:/var/lib/mysql
     restart: always
     networks:
       - backend