Move Traefik out of this stack into its own standalone stack

Fixes a circular dependency: a full stack redeploy tears every service down
before bringing any back up, but claude-agent's image pull goes through
Traefik->Gitea's registry. Self-hosting Traefik in the same stack it fronts
means redeploying this stack could tear down the very route needed to bring
it back. Traefik now lives in ~/traefik/docker-compose.yml as shared infra,
independent of this stack's lifecycle.

docker-compose.yml

@@ -1,35 +1,11 @@
 services:
-  traefik:
-    # Must be >=3.6 — Docker 29 raised its minimum API version to 1.44, and Traefik's
-    # Docker provider only gained version auto-negotiation in v3.6.
-    image: traefik:v3.6
-    container_name: traefik
-    restart: unless-stopped
-    command:
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=web"
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
-      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--log.level=INFO"
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "traefik_letsencrypt:/letsencrypt"
-    networks:
-      - web
-
-  # Routes for services that live in OTHER compose files (Gitea, Portainer) are added
-  # as labels on those containers directly, not here — see README "Fronting existing
-  # services" section.
+  # Traefik deliberately does NOT live in this stack — it's shared infra fronting
+  # Gitea/Portainer/Matrix/agent (see ~/traefik/docker-compose.yml, a separate,
+  # independently-managed stack). It used to be a service here, but a GitOps redeploy
+  # tears every service in a stack down before bringing them back up — and claude-agent's
+  # image pull goes through Traefik→Gitea's registry, so a self-hosted Traefik ends up
+  # briefly tearing down the very route its sibling service needs to come back up.
+  # Circular dependency, self-inflicted outage. Don't put Traefik back in this file.
 
   matrix-homeserver:
     image: ghcr.io/continuwuity/continuwuity:latest
@@ -110,7 +86,6 @@ networks:
     external: true
 
 volumes:
-  traefik_letsencrypt:
   matrix_data:
   agent_workspace:
   act_runner_data: