refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media,
foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev).
Each app stack joins a shared external `edge` network for Caddy and keeps its
DB/cache co-located (no shared backing services). All named volumes convert to
tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry ->
/storage1/labdata (ZFS). Gitea repos+LFS split to ZFS.

Move Vault into the management plane (portainer-compose.yml) and add the shared
`edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl.

Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live
monolith is unchanged. Live cutover (Phase B) is next.

portainer-compose.yml

@@ -1,12 +1,23 @@
-# Management-plane services: portainer, github-runner, watchtower.
-# These manage the application stack rather than being part of it.
+# Management plane: portainer, vault, github-runner, watchtower.
+# These manage / underpin the application stacks rather than being part of them,
+# so they are deployed by raw `docker compose` (NOT a Portainer-managed stack) —
+# Portainer cannot manage the stack that contains Portainer itself.
 #
-# This file also owns the portainer_proxy network that the main
-# docker-compose.yml references as external: true.
+# This file owns the shared infrastructure networks:
+#   - edge            : the single reverse-proxy network. Caddy + every service it
+#                       proxies join this. Replaces caddy's old per-stack network
+#                       membership. App stacks reference it as external.
+#   - portainer_proxy : legacy net for caddy -> portainer. Kept until the monolith
+#                       is fully dismantled, then dropped (portainer is on edge too).
+#
+# Vault lives here (moved out of the dev stack): it is estate-wide secrets infra,
+# must boot before the app stacks, and should not reseal when a dev tool changes.
+# Vault data is the /config/vault bind mount — moving the service definition here
+# does not touch any data. Re-unseal after (apply-compose.ps1 -VaultUnseal).
 #
 # Fresh-install order:
-#   docker compose -f portainer-compose.yml up -d   # network + mgmt plane first
-#   dc up -d                                         # application stack second
+#   docker compose -f portainer-compose.yml up -d   # networks + mgmt plane first
+#   (then create the Portainer git stacks for proxy + each app domain)
 
 services:
   portainer:
@@ -15,6 +26,7 @@ services:
     restart: unless-stopped
     networks:
       - portainer_proxy
+      - edge
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /config/portainer:/data
@@ -23,6 +35,35 @@ services:
     labels:
       - "com.centurylabs.watchtower.enable=false"
 
+  # ============================================================
+  # VAULT (estate-wide secret management)
+  # One-time setup after first start:
+  #   docker exec -it vault vault operator init
+  #   vault operator unseal   (3x with unseal keys)
+  # Unseal keys + root token live in .env (they are the one secret Vault
+  # itself cannot hold). Re-unseal after a restart with:
+  #   powershell -File apply-compose.ps1 -VaultUnseal
+  # ============================================================
+  vault:
+    container_name: vault
+    image: hashicorp/vault:latest
+    restart: unless-stopped
+    networks:
+      - edge
+    cap_add:
+      - IPC_LOCK
+    environment:
+      - VAULT_ADDR=http://0.0.0.0:8200
+    volumes:
+      - /config/vault/config:/vault/config:ro
+      - /config/vault/data:/vault/data
+      - /config/vault/logs:/vault/logs
+    command: vault server -config=/vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+
   github-runner:
     container_name: github_runner
     image: myoung34/github-runner:latest
@@ -55,6 +96,9 @@ services:
       - "com.centurylabs.watchtower.enable=false"
 
 networks:
+  edge:
+    name: edge
+    driver: bridge
   portainer_proxy:
     name: portainer_proxy
     driver: bridge