refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media,
foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev).
Each app stack joins a shared external `edge` network for Caddy and keeps its
DB/cache co-located (no shared backing services). All named volumes convert to
tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry ->
/storage1/labdata (ZFS). Gitea repos+LFS split to ZFS.

Move Vault into the management plane (portainer-compose.yml) and add the shared
`edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl.

Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live
monolith is unchanged. Live cutover (Phase B) is next.

apply-compose.ps1

@@ -64,8 +64,11 @@ if ($Compose) {
 if ($Portainer) {
     Write-Host "Pushing portainer-compose.yml ..."
     scp $portainerLocal "${server}:~/valhalla-lab/portainer-compose.yml"
-    Write-Host "Applying portainer compose ..."
-    ssh $server "docker compose -f ~/valhalla-lab/portainer-compose.yml up -d"
+    Write-Host "Pushing vault.hcl (Vault now lives in the management plane) ..."
+    ssh $server "mkdir -p /config/vault/config /config/vault/data /config/vault/logs"
+    scp $vaultConfigLocal "${server}:/config/vault/config/vault.hcl"
+    Write-Host "Applying management plane (portainer, vault, github-runner, watchtower) ..."
+    ssh $server "docker compose -f ~/valhalla-lab/portainer-compose.yml --env-file ~/valhalla-lab/.env up -d"
 }
 
 if ($DevStack) {