feat: migrate all stacks to Coolify (proxy network, clean labels, pull_policy)

- Remove traefik.enable, traefik.docker.network, traefik.http.routers.* from all services
- Keep traefik.http.services.<name>.loadbalancer.server.port labels
- Keep all middleware definitions (forwardauth, headers, redirects)
- Add pull_policy: always to main/frontend services
- Add proxy network + label to gitea and karakeep (previously missing)
- Add COOLIFY-TEMPLATE.md reference guide

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

wireguard/docker-compose.yml

@@ -2,6 +2,7 @@ services:
   wg-easy:
     image: ${WG_EASY_IMAGE}
     container_name: wg-easy
+    pull_policy: always
     restart: unless-stopped
 
     cap_add:
@@ -37,21 +38,8 @@ services:
       - proxy
 
     labels:
-      traefik.enable: "true"
-      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
-
-      # Router HTTPS para la UI de wg-easy
-      traefik.http.routers.wg.rule: "Host(`${WG_DOMAIN}`)"
-      traefik.http.routers.wg.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
-      traefik.http.routers.wg.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
-
-      # Servicio apuntando al puerto HTTP interno de la UI
       traefik.http.services.wg.loadbalancer.server.port: "${WG_UI_PORT}"
 
-      # Proteger la UI con Authentik (middleware definido en authentik-server)
-      traefik.http.routers.wg.middlewares: "${TRAEFIK_AUTH_MIDDLEWARE}"
-
 networks:
   proxy:
     external: true
-