Move Traefik out of this stack into its own standalone stack

Fixes a circular dependency: a full stack redeploy tears every service down
before bringing any back up, but claude-agent's image pull goes through
Traefik->Gitea's registry. Self-hosting Traefik in the same stack it fronts
means redeploying this stack could tear down the very route needed to bring
it back. Traefik now lives in ~/traefik/docker-compose.yml as shared infra,
independent of this stack's lifecycle.

.env.example

@@ -1,7 +1,8 @@
 # Copy to .env and fill in. Never commit the real .env.
+# Note: ACME_EMAIL / Traefik itself are configured separately in ~/traefik/.env —
+# Traefik is shared infra, not part of this stack (see docker-compose.yml comment).
 
 # --- domain / TLS ---
-ACME_EMAIL=you@example.com
 MATRIX_SERVER_NAME=matrix.apps.williamturner.eu
 AGENT_HOSTNAME=agent.apps.williamturner.eu
 # Set to true ONLY for the first-boot window while creating the bot account,
@@ -13,7 +14,7 @@ GITEA_URL=https://gitea.apps.williamturner.eu
 GITEA_TOKEN=
 GITEA_WEBHOOK_SECRET=
 # Image the agent runs from — built and pushed by .gitea/workflows/build.yml
-GITEA_REGISTRY_IMAGE=gitea.apps.williamturner.eu/<your-gitea-username>/claude-agent:latest
+GITEA_REGISTRY_IMAGE=gitea.apps.williamturner.eu/<your-gitea-username>/<repo-name>/claude-agent:latest
 
 # --- anthropic ---
 ANTHROPIC_API_KEY=