feat: migrate all stacks to Coolify (proxy network, clean labels, pull_policy)

- Remove traefik.enable, traefik.docker.network, traefik.http.routers.* from all services
- Keep traefik.http.services.<name>.loadbalancer.server.port labels
- Keep all middleware definitions (forwardauth, headers, redirects)
- Add pull_policy: always to main/frontend services
- Add proxy network + label to gitea and karakeep (previously missing)
- Add COOLIFY-TEMPLATE.md reference guide

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

paperless/docker-compose.yml

@@ -43,6 +43,7 @@ services:
   paperless:
     image: ghcr.io/paperless-ngx/paperless-ngx:latest
     container_name: paperless
+    pull_policy: always
     restart: unless-stopped
     depends_on:
       - paperless-db
@@ -85,15 +86,6 @@ services:
       - proxy
       - mail_internal
     labels:
-      - traefik.enable=true
-      - traefik.docker.network=proxy
-
-      - traefik.http.routers.paperless.rule=Host(`${PAPERLESS_DOMAIN}`)
-      - traefik.http.routers.paperless.entrypoints=websecure
-      - traefik.http.routers.paperless.tls=true
-      - traefik.http.routers.paperless.tls.certresolver=${TRAEFIK_CERTRESOLVER}
-      - traefik.http.routers.paperless.middlewares=paperless-secure-headers
-
       - traefik.http.middlewares.paperless-secure-headers.headers.stsSeconds=31536000
       - traefik.http.middlewares.paperless-secure-headers.headers.stsIncludeSubdomains=true
       - traefik.http.middlewares.paperless-secure-headers.headers.stsPreload=true
@@ -105,6 +97,7 @@ services:
   paperless-ai:
     image: clusterzx/paperless-ai:latest
     container_name: paperless-ai
+    pull_policy: always
     restart: unless-stopped
     depends_on:
       - paperless
@@ -116,15 +109,6 @@ services:
       - paperless_internal
       - proxy
     labels:
-      - traefik.enable=true
-      - traefik.docker.network=proxy
-
-      - traefik.http.routers.paperless-ai.rule=Host(`${PAPERLESS_AI_DOMAIN}`)
-      - traefik.http.routers.paperless-ai.entrypoints=websecure
-      - traefik.http.routers.paperless-ai.tls=true
-      - traefik.http.routers.paperless-ai.tls.certresolver=${TRAEFIK_CERTRESOLVER}
-      - traefik.http.routers.paperless-ai.middlewares=paperless-ai-secure-headers
-
       - traefik.http.middlewares.paperless-ai-secure-headers.headers.stsSeconds=31536000
       - traefik.http.middlewares.paperless-ai-secure-headers.headers.stsIncludeSubdomains=true
       - traefik.http.middlewares.paperless-ai-secure-headers.headers.stsPreload=true