feat: add GitHub Actions runner workflow and fix portainer network race

- portainer-compose.yml: moves portainer from standalone container to
  compose-managed, giving the portainer_proxy network a compose owner.
  This ensures the network is reliably created before the main stack
  on fresh installs or after Docker state is wiped.
- .github/workflows/deploy.yml: self-hosted runner on valhalla runs
  dc pull + up on push to main, and hot-reloads Caddyfile.
- apply-compose.ps1: adds -Portainer flag to manage portainer-compose.yml.

.github/workflows/deploy.yml

@@ -0,0 +1,30 @@
+name: Deploy to valhalla
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Push .env
+        run: cp .env ~/valhalla-lab/.env
+
+      - name: Push and apply compose
+        run: |
+          cp docker-compose.yml ~/valhalla-lab/docker-compose.yml
+          docker compose -f ~/valhalla-lab/docker-compose.yml \
+            --env-file ~/valhalla-lab/.env pull
+          docker compose -f ~/valhalla-lab/docker-compose.yml \
+            --env-file ~/valhalla-lab/.env up -d
+
+      - name: Push and reload Caddyfile
+        run: |
+          cp Caddyfile /config/caddy/Caddyfile
+          docker compose -f ~/valhalla-lab/docker-compose.yml \
+            --env-file ~/valhalla-lab/.env exec -T caddy \
+            caddy reload --config /etc/caddy/Caddyfile