refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media,
foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev).
Each app stack joins a shared external `edge` network for Caddy and keeps its
DB/cache co-located (no shared backing services). All named volumes convert to
tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry ->
/storage1/labdata (ZFS). Gitea repos+LFS split to ZFS.

Move Vault into the management plane (portainer-compose.yml) and add the shared
`edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl.

Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live
monolith is unchanged. Live cutover (Phase B) is next.

stacks/monitoring/docker-compose.yml

@@ -0,0 +1,35 @@
+# monitoring stack — Uptime Kuma + Homarr dashboard.
+# (Named "monitoring" to avoid confusion with the raw-compose management plane.)
+# Both are bind-mounted and proxied internal-only; both join edge.
+
+services:
+  uptime-kuma:
+    container_name: uptime_kuma
+    image: louislam/uptime-kuma:2
+    restart: unless-stopped
+    networks: [edge]
+    ports:
+      - "3001:3001"
+    volumes:
+      - /config/uptime-kuma:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+
+  homarr:
+    container_name: homarr
+    image: ghcr.io/homarr-labs/homarr:latest
+    restart: unless-stopped
+    networks: [edge]
+    environment:
+      - SECRET_ENCRYPTION_KEY=${HOMARR_SECRET_ENCRYPTION_KEY}
+    ports:
+      - "7575:7575"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /config/homarr/configs:/app/data/configs
+      - /config/homarr/icons:/app/public/icons
+      - /config/homarr/data:/data
+
+networks:
+  edge:
+    name: edge
+    external: true