refactor: split monolith into per-domain stacks (Phase A: build)

Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media,
foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev).
Each app stack joins a shared external `edge` network for Caddy and keeps its
DB/cache co-located (no shared backing services). All named volumes convert to
tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry ->
/storage1/labdata (ZFS). Gitea repos+LFS split to ZFS.

Move Vault into the management plane (portainer-compose.yml) and add the shared
`edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl.

Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live
monolith is unchanged. Live cutover (Phase B) is next.

stacks/resume/docker-compose.yml

@@ -0,0 +1,99 @@
+# resume stack — Reactive Resume app + Postgres, MinIO, and the Chrome printer.
+#
+# Volume -> bind-mount conversions (tiered per density policy):
+#   postgres data  -> /config/resume/postgres        (SSD; DB, low density)
+#   minio  data    -> /storage1/labdata/resume/minio (ZFS; object store, blobs)
+# The Chrome service is stateless. app + resume-minio join edge (resume.ginnoir.com,
+# storage.j-costa.com, minio.ginnoir.com); postgres stays private.
+
+services:
+  postgres:
+    container_name: postgres_resume
+    image: postgres:16-alpine
+    restart: unless-stopped
+    networks: [resume]
+    volumes:
+      - /config/resume/postgres:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DB=postgres
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  resume-minio:
+    container_name: minio_resume
+    image: minio/minio:latest
+    restart: unless-stopped
+    networks: [resume, edge]
+    command: server /data --console-address :9001
+    ports:
+      - "9000:9000"
+      - "9004:9001"
+    volumes:
+      - /storage1/labdata/resume/minio:/data
+    environment:
+      - MINIO_ROOT_USER=${MINIO_ROOT_USER}
+      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
+      interval: 30s
+      timeout: 20s
+      retries: 3
+      start_period: 30s
+
+  chrome:
+    container_name: chrome
+    image: ghcr.io/browserless/chromium:latest
+    restart: unless-stopped
+    networks: [resume]
+    environment:
+      - TIMEOUT=10000
+      - CONCURRENT=10
+      - TOKEN=${CHROME_TOKEN}
+      - EXIT_ON_HEALTH_FAILURE=true
+      - PRE_REQUEST_HEALTH_CHECK=true
+
+  app:
+    container_name: resume
+    image: amruthpillai/reactive-resume:latest
+    restart: unless-stopped
+    networks: [resume, edge]
+    ports:
+      - "3000:3000"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      resume-minio:
+        condition: service_healthy
+      chrome:
+        condition: service_started
+    environment:
+      - PORT=3000
+      - NODE_ENV=production
+      - APP_URL=https://resume.ginnoir.com
+      - STORAGE_URL=https://storage.j-costa.com/default
+      - PRINTER_ENDPOINT=http://chrome:3000
+      - PRINTER_TOKEN=${CHROME_TOKEN}
+      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres
+      - AUTH_SECRET=${RESUME_AUTH_SECRET}
+      - MAIL_FROM=noreply@localhost
+      - STORAGE_ENDPOINT=resume-minio
+      - STORAGE_PORT=9000
+      - STORAGE_REGION=us-east-1
+      - STORAGE_BUCKET=default
+      - STORAGE_ACCESS_KEY=${MINIO_ROOT_USER}
+      - STORAGE_SECRET_KEY=${MINIO_ROOT_PASSWORD}
+      - STORAGE_USE_SSL=false
+      - STORAGE_SKIP_BUCKET_CHECK=false
+
+networks:
+  resume:
+    name: resume
+    driver: bridge
+  edge:
+    name: edge
+    external: true