feat: migrate all stacks to Coolify (proxy network, clean labels, pull_policy)

- Remove traefik.enable, traefik.docker.network, traefik.http.routers.* from all services
- Keep traefik.http.services.<name>.loadbalancer.server.port labels
- Keep all middleware definitions (forwardauth, headers, redirects)
- Add pull_policy: always to main/frontend services
- Add proxy network + label to gitea and karakeep (previously missing)
- Add COOLIFY-TEMPLATE.md reference guide

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

adguard/docker-compose.yml

@@ -2,6 +2,7 @@ services:
   adguardhome:
     image: ${ADGUARD_IMAGE}
     container_name: adguardhome
+    pull_policy: always
     restart: unless-stopped
 
     volumes:
@@ -22,22 +23,8 @@ services:
         ipv4_address: ${ADGUARD_IPV4}
 
     labels:
-      traefik.enable: "true"
-      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
-
-      # Router HTTPS para el panel web
-      traefik.http.routers.adguard.rule: "Host(`${ADGUARD_DOMAIN}`)"
-      traefik.http.routers.adguard.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
-      traefik.http.routers.adguard.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
-
-      # Panel interno de AdGuard (HTTP en el contenedor)
-      # OJO: si es la primera vez y el panel escucha en 3000, cambia a 3000
       traefik.http.services.adguard.loadbalancer.server.port: "${ADGUARD_HTTP_PORT}"
 
-      # Proteger el panel con Authentik (middleware definido en authentik-server)
-      traefik.http.routers.adguard.middlewares: "${TRAEFIK_AUTH_MIDDLEWARE}"
-
 networks:
   proxy:
     external: true
-