refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media,
foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev).
Each app stack joins a shared external `edge` network for Caddy and keeps its
DB/cache co-located (no shared backing services). All named volumes convert to
tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry ->
/storage1/labdata (ZFS). Gitea repos+LFS split to ZFS.

Move Vault into the management plane (portainer-compose.yml) and add the shared
`edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl.

Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live
monolith is unchanged. Live cutover (Phase B) is next.

stacks/proxy/docker-compose.yml

@@ -0,0 +1,37 @@
+# proxy stack — Caddy reverse proxy / TLS terminator.
+#
+# Caddy is the single ingress for the whole estate. It joins only the shared
+# `edge` network (owned by the management plane); every service it proxies also
+# joins `edge`, so `reverse_proxy <service>:<port>` resolves by container name.
+# This replaces Caddy's old membership in 11 separate per-stack networks.
+#
+# The Caddyfile itself is unchanged — upstreams are service names that resolve
+# over edge. It is bind-mounted from /config/caddy/Caddyfile and hot-reloaded
+# by the GitHub Actions runner on push (deploy.yml).
+#
+# serfriz/caddy-cloudflare-ddns bundles caddy-dns/cloudflare (DNS-01 ACME),
+# caddy-cloudflare-ip (real client IPs behind CF), caddy-dynamicdns.
+
+services:
+  caddy:
+    container_name: caddy
+    image: serfriz/caddy-cloudflare-ddns:latest
+    restart: unless-stopped
+    networks:
+      - edge
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - CF_API_TOKEN=${CF_API_TOKEN}
+    volumes:
+      - /config/caddy/Caddyfile:/etc/caddy/Caddyfile
+      - /config/caddy/site:/srv
+      - /config/caddy/data:/data
+      - /config/caddy/config:/config
+      - /storage1/Books:/srv/Books
+
+networks:
+  edge:
+    name: edge
+    external: true