feat(roms): add RomM stack (romm + mariadb) over /storage1/Emulation

New per-domain stack centralizing the emulation/ROM library:

- romm (rommapp/romm:4) + dedicated MariaDB; RomM bundles its own Redis

- library mounts existing EmuDeck tree /storage1/Emulation (RomM Structure A) read-write; tiered binds (config->/config, blobs->/storage1/labdata)

- env_file-only config (no ${VAR}) so the git stack needs no Portainer UI env vars

- Hasheous metadata enabled; IGDB/SteamGridDB/ScreenScraper scaffolded empty

- Caddy: roms.ginnoir.com internal_only -> romm:8080; regenerated bookmarks

stacks/roms/stack.env

@@ -0,0 +1,34 @@
+# roms stack secrets — RomM + MariaDB.
+# Var names are exactly what each container reads, injected via env_file (no ${VAR}
+# interpolation), so this git stack needs no Portainer UI env vars.
+TZ=America/Chicago
+
+# ── RomM <-> MariaDB connection ─────────────────────────────────────────────
+# DB_HOST / DB_NAME are set literally in docker-compose.yml.
+DB_USER=romm-user
+DB_PASSWD=75d3308745e974b52d10ec78100dc106
+
+# RomM session/JWT signing key. Rotate with: openssl rand -hex 32
+# (rotating invalidates all logged-in sessions)
+ROMM_AUTH_SECRET_KEY=587a4e5a51f932ec8bc0b785364b20911053b2523aee0a5254b5474f8c04b97f
+
+# ── MariaDB init ────────────────────────────────────────────────────────────
+# MARIADB_PASSWORD MUST equal DB_PASSWD above.
+MARIADB_ROOT_PASSWORD=6f54df0f4a31c761061b87ac2d7dd7e1
+MARIADB_DATABASE=romm
+MARIADB_USER=romm-user
+MARIADB_PASSWORD=75d3308745e974b52d10ec78100dc106
+
+# ── Metadata sources ────────────────────────────────────────────────────────
+# Hasheous is free and needs no account — leave enabled so RomM matches on day one.
+HASHEOUS_API_ENABLED=true
+
+# Fill these later. RomM runs on Hasheous alone until then.
+# IGDB:        create a Twitch dev app -> https://dev.twitch.tv/console/apps
+# SteamGridDB: API key -> https://www.steamgriddb.com/profile/preferences/api
+# ScreenScraper: your account username/password -> https://www.screenscraper.fr
+IGDB_CLIENT_ID=
+IGDB_CLIENT_SECRET=
+STEAMGRIDDB_API_KEY=
+SCREENSCRAPER_USER=
+SCREENSCRAPER_PASSWORD=