ci: migrate to Portainer Git stack + registry-pushed images

- Compose: build → image (Gitea registry ci namespace) for backend + frontend
- Workflow: build + push both + POST Portainer webhook (3-attempt retry)
- Drop docker compose up on host
- Add crowdsec@file to middlewares chain

Repo secrets required: REGISTRY_TOKEN, PORTAINER_WEBHOOK_URL.
Rollback branch: pre-portainer-migration.

flight-comparator/docker-compose.yml

@@ -1,10 +1,8 @@
-name: flight-radar   # pins the project name — must match COMPOSE_PROJECT in .gitea/workflows/deploy.yml
+name: flight-radar
 
 services:
   backend:
-    build:
-      context: .
-      dockerfile: Dockerfile.backend
+    image: git.domverse-berlin.eu/ci/ciaovolo/backend:${TAG:-latest}
     container_name: flight-radar-backend
     restart: unless-stopped
     environment:
@@ -16,37 +14,31 @@ services:
     networks:
       - default
       - domverse
-    # No ports exposed — only reachable by the frontend via nginx proxy
 
   frontend:
-    build:
-      context: .
-      dockerfile: Dockerfile.frontend
+    image: git.domverse-berlin.eu/ci/ciaovolo/frontend:${TAG:-latest}
     container_name: flight-radar-frontend
     restart: unless-stopped
     depends_on:
       - backend
     networks:
-      - default   # shares default compose network with backend (nginx → http://backend:8000)
-      - domverse  # Traefik discovers the container on this network
+      - default
+      - domverse
     labels:
-      # Traefik routing
       - "traefik.docker.network=domverse"
       - "traefik.enable=true"
       - "traefik.http.routers.flight-radar.rule=Host(`flights.domverse-berlin.eu`)"
       - "traefik.http.routers.flight-radar.entrypoints=https"
       - "traefik.http.routers.flight-radar.tls.certresolver=http"
-      - "traefik.http.routers.flight-radar.middlewares=authentik@docker"
+      - "traefik.http.routers.flight-radar.middlewares=crowdsec@file,authentik@docker"
       - "traefik.http.services.flight-radar.loadbalancer.server.port=80"
 
-      # AutoKuma monitoring
       - "kuma.flight-radar.http.name=Flight Radar"
       - "kuma.flight-radar.http.url=https://flights.domverse-berlin.eu"
       - "kuma.flight-radar.http.interval=60"
       - "kuma.flight-radar.http.max_retries=2"
       - "kuma.flight-radar.http.retry_interval=60"
 
-      # Homepage dashboard
       - "homepage.group=Productivity"
       - "homepage.name=Flight Radar"
       - "homepage.icon=mdi-airplane"
@@ -59,6 +51,6 @@ volumes:
     driver: local
 
 networks:
-  default: {}   # explicit declaration required when any service has a custom networks block
+  default: {}
   domverse:
     external: true