fix: replace variable bind mounts with hardcoded paths/named volumes

Coolify converts ${VAR}:/path bind mounts to named Docker volumes when
the variable is not resolved. Fixed per stack:

- adguard: -> named volumes (data already in Coolify-created volumes)
- authentik: -> named volumes (data already in Coolify-created volumes)
- gitea: -> /opt/gitea/{postgres,data,runner}
- mail-relay: -> /opt/mail-relay/{queue,opendkim,secrets/...}
- media-server: COMMON_PATH -> /opt/media (hardcoded)
- trilium: -> /opt/trilium/data
- wireguard: -> /opt/wg-easy + /lib/modules

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

adguard/docker-compose.yml

@@ -6,10 +6,10 @@ services:
     restart: unless-stopped
 
     volumes:
-      - ${ADGUARD_WORK_PATH}:/opt/adguardhome/work:Z
-      - ${ADGUARD_CONF_PATH}:/opt/adguardhome/conf:Z
-      - ${ADGUARD_CERT_CRT_PATH}:/certs/adguard.crt:ro,Z
-      - ${ADGUARD_CERT_KEY_PATH}:/certs/adguard.key:ro,Z
+      - adguard-work-path:/opt/adguardhome/work:Z
+      - adguard-conf-path:/opt/adguardhome/conf:Z
+      - adguard-cert-crt-path:/certs/adguard.crt:ro,Z
+      - adguard-cert-key-path:/certs/adguard.key:ro,Z
 
     # Solo DNS/DoT expuestos en el host
     ports:
@@ -25,6 +25,12 @@ services:
     labels:
       traefik.http.services.adguard.loadbalancer.server.port: "${ADGUARD_HTTP_PORT}"
 
+volumes:
+  adguard-work-path:
+  adguard-conf-path:
+  adguard-cert-crt-path:
+  adguard-cert-key-path:
+
 networks:
   proxy:
     external: true