refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media,
foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev).
Each app stack joins a shared external `edge` network for Caddy and keeps its
DB/cache co-located (no shared backing services). All named volumes convert to
tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry ->
/storage1/labdata (ZFS). Gitea repos+LFS split to ZFS.

Move Vault into the management plane (portainer-compose.yml) and add the shared
`edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl.

Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live
monolith is unchanged. Live cutover (Phase B) is next.

stacks/media/.env

@@ -0,0 +1,5 @@
+# media stack config
+TZ=America/Chicago
+PUID=1000
+PGID=1000
+ROOT=/

stacks/media/docker-compose.yml

@@ -0,0 +1,206 @@
+# media stack — *arr suite, download clients, and media utilities.
+# All config/data is bind-mounted to /config and /storage1 already (no named
+# volumes to migrate). Services join the private `media` net for inter-app
+# traffic (prowlarr<->sonarr/radarr) and `edge` so Caddy can proxy them.
+
+services:
+  deluge:
+    container_name: deluge
+    image: lscr.io/linuxserver/deluge:latest
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - ${ROOT}/storage1/torrents:/downloads
+      - ${ROOT}/config/deluge:/config
+    ports:
+      - "8112:8112"
+
+  nzbget:
+    container_name: nzbget
+    image: lscr.io/linuxserver/nzbget:latest
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - ${ROOT}/storage1/complete:/downloads
+      - ${ROOT}/config/nzbget:/config
+    ports:
+      - "6789:6789"
+
+  sonarr:
+    container_name: sonarr
+    image: lscr.io/linuxserver/sonarr:latest
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ${ROOT}/config/sonarr:/config
+      - ${ROOT}/storage1/Media/TV:/tv
+      - ${ROOT}/storage1/Media/Anime:/anime
+      - ${ROOT}/storage1/complete:/downloads
+    ports:
+      - "8989:8989"
+
+  radarr:
+    container_name: radarr
+    image: lscr.io/linuxserver/radarr:latest
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ${ROOT}/config/radarr:/config
+      - ${ROOT}/storage1/Media/Movies:/movies
+      - ${ROOT}/storage1/complete:/downloads
+    ports:
+      - "7878:7878"
+
+  bazarr:
+    container_name: bazarr
+    image: lscr.io/linuxserver/bazarr:latest
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK_SET=022
+    volumes:
+      - ${ROOT}/config/bazarr:/config
+      - ${ROOT}/storage1/Media/Movies:/movies
+      - ${ROOT}/storage1/Media/TV:/tv
+      - ${ROOT}/storage1/Media/Anime:/anime
+    ports:
+      - "6767:6767"
+
+  prowlarr:
+    container_name: prowlarr
+    image: ghcr.io/hotio/prowlarr:latest
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - UMASK=002
+      - TZ=${TZ}
+    volumes:
+      - /config/prowlarr:/config
+    ports:
+      - "9696:9696"
+
+  overseerr:
+    container_name: overseerr
+    image: sctx/overseerr:latest
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - UMASK=002
+      - TZ=${TZ}
+    volumes:
+      - /config/overseerr:/app/config
+    ports:
+      - "5055:5055"
+
+  tautulli:
+    image: ghcr.io/linuxserver/tautulli:latest
+    container_name: tautulli
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - ${ROOT}/config/tautulli:/config
+      - ${ROOT}/storage1/PMS:/logs
+    ports:
+      - "8181:8181"
+
+  qbittorrent:
+    image: lscr.io/linuxserver/qbittorrent:latest
+    container_name: qbittorrent
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=${TZ}
+      - WEBUI_PORT=3232
+      - TORRENTING_PORT=6881
+    volumes:
+      - /config/qbittorrent:/config
+      - /storage1/complete:/downloads
+    ports:
+      - "3232:3232"
+      - "6881:6881"
+      - "6881:6881/udp"
+
+  whisparr:
+    container_name: whisparr
+    image: ghcr.io/hotio/whisparr:latest
+    restart: unless-stopped
+    networks: [media, edge]
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - UMASK=002
+      - TZ=${TZ}
+      - WEBUI_PORTS=6969/tcp
+    volumes:
+      - /config/whisparr:/config
+      - /storage1:/data
+    ports:
+      - "6969:6969"
+
+  stash:
+    image: stashapp/stash:latest
+    container_name: stash
+    restart: unless-stopped
+    networks: [media, edge]
+    logging:
+      driver: json-file
+      options:
+        max-file: "10"
+        max-size: "2m"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - STASH_STASH=/data/
+      - STASH_GENERATED=/generated/
+      - STASH_METADATA=/metadata/
+      - STASH_CACHE=/cache/
+      - STASH_PORT=6970
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /config/stash:/root/.stash
+      - /storage1/LinuxISOs:/data
+      - /storage1/stash/metadata:/metadata
+      - /storage1/stash/cache:/cache
+      - /storage1/stash/blobs:/blobs
+      - /storage1/stash/generated:/generated
+    ports:
+      - "6971:6970"
+
+networks:
+  media:
+    name: media
+    driver: bridge
+  edge:
+    name: edge
+    external: true