guacamole: wire session recording to Synology NFS

Phase 5 of docs/infrastructure/guacamole-customization-plan.md:

- Mount /volume1/kubernetes/guacamole/recordings (Synology 10.0.58.3)
  into both guacd (writer) and guacamole web (reader) at
  /var/lib/guacamole/recordings
- Set RECORDING_SEARCH_PATH env on guacamole web -- the Guacamole
  Docker entrypoint treats any RECORDING_* var as an enable signal
  for the history-recording-storage extension (symlinks the JAR
  from /opt/guacamole/environment/RECORDING_/extensions/ into
  GUACAMOLE_HOME/extensions/)

Per-connection recording still requires setting recording-path on
each connection in MySQL -- follow-up task. This commit enables
the plumbing; no sessions record yet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/guacamole/guacamole.yaml

@@ -198,6 +198,9 @@ spec:
               port: 4822
             initialDelaySeconds: 15
             periodSeconds: 10
+          volumeMounts:
+            - name: recordings
+              mountPath: /var/lib/guacamole/recordings
         - name: kubectl-proxy
           image: bitnami/kubectl:latest
           args:
@@ -215,6 +218,11 @@ spec:
             limits:
               memory: 64Mi
               cpu: 50m
+      volumes:
+        - name: recordings
+          nfs:
+            server: 10.0.58.3
+            path: /volume1/kubernetes/guacamole/recordings
 ---
 apiVersion: v1
 kind: Service
@@ -277,6 +285,11 @@ spec:
                 secretKeyRef:
                   name: guacamole-credentials
                   key: DB-Password
+            # RECORDING_* presence triggers history-recording-storage extension load
+            # per Guacamole Docker convention (/opt/guacamole/environment/RECORDING_/).
+            # Recordings are written by guacd and read by guacamole web (history UI).
+            - name: RECORDING_SEARCH_PATH
+              value: /var/lib/guacamole/recordings
           resources:
             requests:
               memory: 256Mi
@@ -303,6 +316,8 @@ spec:
             - name: bluejay-branding
               mountPath: /etc/guacamole/extensions/bluejay-branding-1.0.0.jar
               subPath: bluejay-branding-1.0.0.jar
+            - name: recordings
+              mountPath: /var/lib/guacamole/recordings
       volumes:
         - name: guac-properties
           configMap:
@@ -310,6 +325,10 @@ spec:
         - name: bluejay-branding
           configMap:
             name: guacamole-branding
+        - name: recordings
+          nfs:
+            server: 10.0.58.3
+            path: /volume1/kubernetes/guacamole/recordings
 ---
 apiVersion: v1
 kind: Service