docs+ops: rewrite CLAUDE.md, skills, runner for post-split topology

Post-monolith documentation and ops cleanup:

- CLAUDE.md rewritten end-to-end. Documents the 11 Portainer-managed stacks
  + raw-compose management plane, the single shared `edge` network, the
  SSD-vs-ZFS bind-mount tiering, the four deployment channels (git push
  for app stacks, runner for Caddyfile, apply-compose.ps1 for mgmt plane /
  Caddyfile / vault), and the fact that the repo is now canonical.
- homelab-apply skill rewritten for the new channels — no more `dc up -d`,
  no more monolith.
- homelab-ssh skill rewritten — no `dc` alias, plain `docker` against
  container names; per-stack compose ops via /data/compose/<id>/...
- homelab-sync skill + sync-prod.ps1 retired. The repo is canonical now;
  pulling from prod is the wrong direction.
- .github/workflows/deploy.yml: drop the dc up -d steps, gate on
  paths:[Caddyfile, .github/workflows/deploy.yml], reload caddy via
  `docker exec` (no longer through compose).
- apply-compose.ps1: drop -Compose and -DevStack flags; -Caddy now reloads
  via `docker exec caddy` (Caddy is in its own Portainer stack now).

No live container is touched by this commit. The runner workflow is
currently disabled at the repo level; re-enabling it makes Caddyfile pushes
auto-deploy again.

apply-compose.ps1

@@ -1,25 +1,22 @@
-# Push .env, Caddyfile, and docker-compose.yml to valhalla, then apply them
-# to the live Docker stack.
+# Manual ops helper for the management plane + Caddyfile + Vault.
 #
-# On valhalla, `dc` is aliased (in ~/.bashrc) to:
-#   docker compose -f ~/valhalla-lab/docker-compose.yml --env-file ~/valhalla-lab/.env
-# It's a shell alias, so we invoke it over SSH with `bash -ic` to load it.
+# Post-split topology: every application stack lives under stacks/<domain>/ and
+# is deployed by Portainer's git poll — there is no monolithic root compose any
+# more, so this script no longer pushes one. The runner workflow (deploy.yml)
+# handles Caddyfile reload on push automatically; -Caddy here is for ad-hoc
+# pushes when you don't want to wait for the runner.
 #
-# Usage (flags combine; no flags = push & apply all three):
-#   powershell -File apply-compose.ps1             # .env + Caddyfile + compose
-#   powershell -File apply-compose.ps1 -EnvFile    # .env only
-#   powershell -File apply-compose.ps1 -Caddy      # Caddyfile only + hot-reload Caddy
-#   powershell -File apply-compose.ps1 -Compose    # docker-compose.yml only + pull + up -d
-#   powershell -File apply-compose.ps1 -Portainer  # portainer-compose.yml only + up -d
-#   powershell -File apply-compose.ps1 -DevStack      # dev-compose.yml + vault.hcl + up -d
-#   powershell -File apply-compose.ps1 -VaultUnseal   # unseal vault after restart (uses keys from .env)
+# Usage (flags combine; no flags = .env + Caddyfile):
+#   powershell -File apply-compose.ps1                 # .env + Caddyfile
+#   powershell -File apply-compose.ps1 -EnvFile        # .env only (mgmt plane / vault unseal)
+#   powershell -File apply-compose.ps1 -Caddy          # Caddyfile only + hot-reload Caddy
+#   powershell -File apply-compose.ps1 -Portainer      # portainer-compose.yml + vault.hcl + up -d
+#   powershell -File apply-compose.ps1 -VaultUnseal    # unseal vault after restart (keys from .env)
 
 param(
-    [switch]$Compose,
     [switch]$Caddy,
     [switch]$EnvFile,
     [switch]$Portainer,
-    [switch]$DevStack,
     [switch]$VaultUnseal
 )
 
@@ -28,16 +25,14 @@ $ErrorActionPreference = "Stop"
 $PSNativeCommandUseErrorActionPreference = $true
 
 $server           = "ginnoir@valhalla"
-$composeLocal     = Join-Path $PSScriptRoot "docker-compose.yml"
 $caddyLocal       = Join-Path $PSScriptRoot "Caddyfile"
 $envLocal         = Join-Path $PSScriptRoot ".env"
 $portainerLocal   = Join-Path $PSScriptRoot "portainer-compose.yml"
-$devComposeLocal  = Join-Path $PSScriptRoot "dev-compose.yml"
 $vaultConfigLocal = Join-Path $PSScriptRoot "vault.hcl"
 
-# Default (no flags): push everything.
-if (-not $Compose -and -not $Caddy -and -not $EnvFile -and -not $Portainer -and -not $DevStack -and -not $VaultUnseal) {
-    $EnvFile = $true; $Caddy = $true; $Compose = $true
+# Default (no flags): push .env + Caddyfile.
+if (-not $Caddy -and -not $EnvFile -and -not $Portainer -and -not $VaultUnseal) {
+    $EnvFile = $true; $Caddy = $true
 }
 
 if ($EnvFile) {
@@ -49,40 +44,19 @@ if ($Caddy) {
     Write-Host "Pushing Caddyfile ..."
     scp $caddyLocal "${server}:/config/caddy/Caddyfile"
     Write-Host "Reloading Caddy ..."
-    ssh $server "bash -ic 'dc exec caddy caddy reload --config /etc/caddy/Caddyfile'"
-}
-
-if ($Compose) {
-    Write-Host "Pushing docker-compose.yml ..."
-    scp $composeLocal "${server}:~/valhalla-lab/docker-compose.yml"
-    Write-Host "Pulling latest images ..."
-    ssh $server "bash -ic 'dc pull'"
-    Write-Host "Applying compose changes (recreates only changed containers) ..."
-    ssh $server "bash -ic 'dc up -d'"
+    ssh $server "docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
 }
 
 if ($Portainer) {
     Write-Host "Pushing portainer-compose.yml ..."
     scp $portainerLocal "${server}:~/valhalla-lab/portainer-compose.yml"
-    Write-Host "Pushing vault.hcl (Vault now lives in the management plane) ..."
+    Write-Host "Pushing vault.hcl (Vault lives in the management plane) ..."
     ssh $server "mkdir -p /config/vault/config /config/vault/data /config/vault/logs"
     scp $vaultConfigLocal "${server}:/config/vault/config/vault.hcl"
     Write-Host "Applying management plane (portainer, vault, github-runner, watchtower) ..."
     ssh $server "docker compose -f ~/valhalla-lab/portainer-compose.yml --env-file ~/valhalla-lab/.env up -d"
 }
 
-if ($DevStack) {
-    Write-Host "Pushing dev-compose.yml ..."
-    scp $devComposeLocal "${server}:~/valhalla-lab/dev-compose.yml"
-    Write-Host "Pushing vault.hcl ..."
-    ssh $server "mkdir -p /config/vault/config /config/vault/data /config/vault/logs"
-    scp $vaultConfigLocal "${server}:/config/vault/config/vault.hcl"
-    Write-Host "Pulling latest dev images ..."
-    ssh $server "docker compose -f ~/valhalla-lab/dev-compose.yml --env-file ~/valhalla-lab/.env pull"
-    Write-Host "Applying dev stack (recreates only changed containers) ..."
-    ssh $server "docker compose -f ~/valhalla-lab/dev-compose.yml --env-file ~/valhalla-lab/.env up -d"
-}
-
 if ($VaultUnseal) {
     # Load the three unseal keys from .env
     $envContent = Get-Content $envLocal | Where-Object { $_ -match "^VAULT_UNSEAL_KEY_[123]=" }