feat: add GitHub Actions runner workflow and fix portainer network race

- portainer-compose.yml: moves portainer from standalone container to
  compose-managed, giving the portainer_proxy network a compose owner.
  This ensures the network is reliably created before the main stack
  on fresh installs or after Docker state is wiped.
- .github/workflows/deploy.yml: self-hosted runner on valhalla runs
  dc pull + up on push to main, and hot-reloads Caddyfile.
- apply-compose.ps1: adds -Portainer flag to manage portainer-compose.yml.

apply-compose.ps1

@@ -10,24 +10,27 @@
 #   powershell -File apply-compose.ps1 -EnvFile    # .env only
 #   powershell -File apply-compose.ps1 -Caddy      # Caddyfile only + hot-reload Caddy
 #   powershell -File apply-compose.ps1 -Compose    # docker-compose.yml only + pull + up -d
+#   powershell -File apply-compose.ps1 -Portainer  # portainer-compose.yml only + up -d
 
 param(
     [switch]$Compose,
     [switch]$Caddy,
-    [switch]$EnvFile
+    [switch]$EnvFile,
+    [switch]$Portainer
 )
 
 $ErrorActionPreference = "Stop"
 # Make a non-zero exit from scp/ssh abort the script instead of silently continuing.
 $PSNativeCommandUseErrorActionPreference = $true
 
-$server       = "ginnoir@valhalla"
-$composeLocal = Join-Path $PSScriptRoot "docker-compose.yml"
-$caddyLocal   = Join-Path $PSScriptRoot "Caddyfile"
-$envLocal     = Join-Path $PSScriptRoot ".env"
+$server           = "ginnoir@valhalla"
+$composeLocal     = Join-Path $PSScriptRoot "docker-compose.yml"
+$caddyLocal       = Join-Path $PSScriptRoot "Caddyfile"
+$envLocal         = Join-Path $PSScriptRoot ".env"
+$portainerLocal   = Join-Path $PSScriptRoot "portainer-compose.yml"
 
 # Default (no flags): push everything.
-if (-not $Compose -and -not $Caddy -and -not $EnvFile) {
+if (-not $Compose -and -not $Caddy -and -not $EnvFile -and -not $Portainer) {
     $EnvFile = $true; $Caddy = $true; $Compose = $true
 }
 
@@ -52,4 +55,11 @@ if ($Compose) {
     ssh $server "bash -ic 'dc up -d'"
 }
 
+if ($Portainer) {
+    Write-Host "Pushing portainer-compose.yml ..."
+    scp $portainerLocal "${server}:~/valhalla-lab/portainer-compose.yml"
+    Write-Host "Applying portainer compose ..."
+    ssh $server "docker compose -f ~/valhalla-lab/portainer-compose.yml up -d"
+}
+
 Write-Host "Done."