feat: add GitHub Actions runner workflow and fix portainer network race

- portainer-compose.yml: moves portainer from standalone container to
  compose-managed, giving the portainer_proxy network a compose owner.
  This ensures the network is reliably created before the main stack
  on fresh installs or after Docker state is wiped.
- .github/workflows/deploy.yml: self-hosted runner on valhalla runs
  dc pull + up on push to main, and hot-reloads Caddyfile.
- apply-compose.ps1: adds -Portainer flag to manage portainer-compose.yml.

portainer-compose.yml

@@ -0,0 +1,29 @@
+# Portainer is managed by this separate compose file so it owns the
+# portainer_proxy network. The main docker-compose.yml references it
+# as external: true. Bring this up BEFORE the main stack on fresh installs.
+#
+# On the server: ~/valhalla-lab/portainer-compose.yml
+#
+# Migration from standalone container:
+#   docker stop portainer && docker rm portainer
+#   docker network rm portainer_proxy      # remove orphaned standalone network
+#   docker compose -f portainer-compose.yml up -d
+#   dc up -d                               # reconnects caddy to new network
+
+services:
+  portainer:
+    container_name: portainer
+    image: portainer/portainer-ce:latest
+    restart: unless-stopped
+    networks:
+      - portainer_proxy
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /config/portainer:/data
+    ports:
+      - "9100:9000"
+
+networks:
+  portainer_proxy:
+    name: portainer_proxy
+    driver: bridge