Move Traefik out of this stack into its own standalone stack

Fixes a circular dependency: a full stack redeploy tears every service down
before bringing any back up, but claude-agent's image pull goes through
Traefik->Gitea's registry. Self-hosting Traefik in the same stack it fronts
means redeploying this stack could tear down the very route needed to bring
it back. Traefik now lives in ~/traefik/docker-compose.yml as shared infra,
independent of this stack's lifecycle.

act-runner-config.yaml

@@ -1,6 +1,4 @@
-# Mounts the host Docker socket into every job container act_runner creates, so
-# `docker build`/`docker push` work inside workflow steps (Docker-outside-of-Docker).
-# This is a runner-admin-controlled default (not something a workflow author can
-# request itself), which is the safer of the two ways act_runner supports this.
-container:
-  options: "-v /var/run/docker.sock:/var/run/docker.sock"
+# act_runner auto-detects that it has its own /var/run/docker.sock mounted (see
+# docker-compose.yml) and passes it through to job containers itself — no explicit
+# options needed here. This file is kept (even near-empty) so CONFIG_FILE has a
+# stable target if runner-level settings are needed later.