refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media,
foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev).
Each app stack joins a shared external `edge` network for Caddy and keeps its
DB/cache co-located (no shared backing services). All named volumes convert to
tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry ->
/storage1/labdata (ZFS). Gitea repos+LFS split to ZFS.

Move Vault into the management plane (portainer-compose.yml) and add the shared
`edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl.

Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live
monolith is unchanged. Live cutover (Phase B) is next.

stacks/dev/.env

@@ -0,0 +1,19 @@
+# dev stack secrets
+TZ=America/Chicago
+
+# Gitea
+GITEA_DB_PASSWORD=gitea_d3vp4ss_9f2k
+
+# code-server (VS Code in browser)
+CODE_SERVER_PASSWORD=c0de_s3rver_pass
+
+# BookStack wiki
+BOOKSTACK_DB_PASSWORD=bookstack_d3v_pass
+BOOKSTACK_DB_ROOT_PASSWORD=bookstack_r00t_pass
+
+# Plane project management
+# Rotate with: openssl rand -hex 32
+PLANE_SECRET_KEY=60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b52
+PLANE_DB_PASSWORD=plane_d3v_p4ss_8x3m
+PLANE_MINIO_USER=planeadmin
+PLANE_MINIO_PASSWORD=plane_minio_p4ss