feat: migrate stack to Portainer git-managed, rename project to valhalla-lab

- Rename project from htpc-download-box to valhalla-lab (directory + dc alias)
- Remove portainer and watchtower from compose; run standalone outside managed stack
  to prevent self-termination during Portainer-triggered redeployments
- Add portainer_proxy external network shared by caddy and standalone portainer
  so Caddy can route to Portainer via Docker DNS without them being in the same stack
- Carve out POST /api/stacks/webhooks/* in Caddyfile so Portainer webhooks can
  reach through the internal_only guard without exposing the full UI
- Update apply-compose.ps1 and sync-prod.ps1 paths from htpc-download-box to valhalla-lab

docker-compose.yml

@@ -76,6 +76,7 @@ services:
       - famapp
       - authentik
       - management
+      - portainer_proxy
     ports:
       - "80:80"
       - "443:443"
@@ -566,18 +567,6 @@ services:
   # ============================================================
   # MANAGEMENT
   # ============================================================
-  portainer:
-    container_name: portainer
-    image: portainer/portainer-ce:latest
-    restart: unless-stopped
-    networks:
-      - management
-    ports:
-      - "9100:9000"
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /config/portainer:/data
-
   uptime-kuma:
     container_name: uptime_kuma
     image: louislam/uptime-kuma:2
@@ -618,17 +607,6 @@ services:
     ports:
       - "9009:80"
 
-  watchtower:
-    container_name: watchtower
-    image: containrrr/watchtower:latest
-    restart: unless-stopped
-    environment:
-      - WATCHTOWER_NOTIFICATION_SKIP_TITLE=true
-      - WATCHTOWER_NOTIFICATION_URL=ntfy://ntfy.ginnoir.com/watchtower?title=WatchtowerUpdates
-      - DOCKER_API_VERSION=1.40
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-
   # ============================================================
   # FAMAPP
   # ============================================================
@@ -801,6 +779,8 @@ networks:
   famapp:
   authentik:
   management:
+  portainer_proxy:
+    external: true
 
 volumes:
   minio_data: