Add registry-ui, automated GC, and Gitea runner/rate-limit fixes

- Deploy joxit/docker-registry-ui at cr.ladkau.de/ (Traefik routes
  /v2/ to registry, everything else to UI; REGISTRY_SECURED=true)
- Add weekly cron job (Sunday 03:00) to delete stale uploads, run
  registry garbage-collect, and prune dangling host images
- Remove rate-limit@docker middleware from Gitea router (act_runner
  polling at 2s intervals exceeded the 60 req/min limit)
- Set Traefik websecure readTimeout: 0 to fix large layer upload 499s
- Remove registry rate-limit middleware (was blocking concurrent pushes)

docs/runbook-configuration.md

@@ -434,7 +434,32 @@ ansible-vault edit ansible/group_vars/all/vault.yml
 ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags registry --ask-vault-pass
 ```
 
-### 8.2 Registry web UI
+### 8.2 Automated garbage collection
+
+A cleanup script runs every **Sunday at 03:00** via cron (deployed by the
+`registry` Ansible role). Each run:
+
+1. Deletes stale `_uploads/` sessions (failed or abandoned pushes)
+2. Stops the registry, runs `garbage-collect` to remove unreferenced blobs,
+   then restarts it
+3. Prunes dangling Docker images from the host
+
+Output is appended to `/var/log/registry-gc.log` and tagged `registry-gc` in
+syslog. To check recent runs:
+
+```bash
+tail -50 /var/log/registry-gc.log
+# or
+grep registry-gc /var/log/syslog
+```
+
+To run manually at any time:
+
+```bash
+sudo /usr/local/bin/registry-gc
+```
+
+### 8.3 Registry web UI
 
 A web dashboard is available at `https://cr.ladkau.de/`. Sign in with any
 `registry_users` credential from the vault. The UI allows browsing repositories