ci: migrate to Portainer Git stack + registry-pushed image

- Compose: build → image (Gitea registry ci namespace)
- Workflow: build + push UI image + POST Portainer webhook (3-attempt retry)
- Drop transient .env file; secrets via Portainer stack Env
- Drop auto-version-bump commit-back
- Add crowdsec@file to middlewares chain

Repo secrets required: REGISTRY_TOKEN, PORTAINER_WEBHOOK_URL.
Rollback branch: pre-portainer-migration.

docker-compose.yml

@@ -29,14 +29,11 @@ services:
       - "traefik.http.routers.outline-sync.rule=Host(`sync.domverse-berlin.eu`)"
       - "traefik.http.routers.outline-sync.entrypoints=https"
       - "traefik.http.routers.outline-sync.tls.certresolver=http"
-      - "traefik.http.routers.outline-sync.middlewares=authentik@docker"
+      - "traefik.http.routers.outline-sync.middlewares=crowdsec@file,authentik@docker"
       - "traefik.http.services.outline-sync.loadbalancer.server.port=8080"
 
   outline-sync-ui:
-    build:
-      context: .
-      args:
-        APP_VERSION: ${APP_VERSION:-dev}
+    image: git.domverse-berlin.eu/ci/outline-sync/ui:${TAG:-latest}
     container_name: outline-sync-ui
     restart: unless-stopped
     depends_on: