fix(service): revive posthog template

[Prains]

Changes

• Revives the abandoned PostHog template fix from fix(service): posthog template #8739 on the current next branch.
• Re-enables PostHog as a one-click template.
• Uses Coolify service URL labels instead of an internal proxy container.
• Keeps named volumes out of the source template.
• Adds permissions-init for ClickHouse UID 101 and livestream/Temporal UID 1000 bind directories.
• Updates livestream with shared GeoIP DB, configs.yml, and event/session-recording consumers from fix(service): posthog template #8739 review feedback.
• Hardens geoip-init to replace corrupt GeoIP files, skip valid files, fail closed on invalid downloads, and preserve shell variables after Compose interpolation.

Issues

• Fixes [Bug]: Posthog Template not working  #3597
• Supersedes fix(service): posthog template #8739.

Category

• Bug fix
• Improvement
• New feature
• Adding new one click service
• Fixing or updating existing one click service

Preview

N/A — service template change. Verified with local generator, rendered Docker Compose, and throwaway Docker Compose smoke tests.

AI Assistance

• AI was NOT used to create this PR
• AI was used (please describe below)

If AI was used:

• Tools used: OpenAI Codex
• How extensively: Used for PR/review inspection, implementation, local validation, and independent review/QA.

Testing

• Generated service templates locally and verified PostHog includes permissions-init, livestream, and hardened geoip-init.
• Targeted service-template tests passed: 1 test / 2 assertions and 7 tests / 15 assertions.
• Rendered the template to plain Docker Compose and ran config validation.
• Ran throwaway smoke tests for permissions ownership, fresh GeoIP download, corrupt GeoIP replacement, and valid GeoIP skip.
• Ran git diff whitespace validation.
• Confirmed only the PostHog compose template is tracked in the final commit.

Contributor Agreement

Important

• I have read and understood the contributor guidelines. If I have failed to follow any guideline, I understand that this PR may be closed without review.
• I have searched existing issues and pull requests (including closed ones) to ensure this isn't a duplicate.
• I have tested all the changes thoroughly with a local development instance of Coolify and I am confident that they will work as expected when a maintainer tests them.