Add Clay agent interface, fix registry UI routing, and misc improvements

- Deploy Clay (claude Code web UI) at agent.ladkau.de behind basic auth;
  Traefik proxies to clay's HTTPS port 2633 with insecureSkipVerify
- Document MCP server persistence: binaries need to be baked into the
  Dockerfile, config in /opt/clay/data survives rebuilds
- Document scheduled agent workflows via Gitea Actions on.schedule with
  email reporting via Gmail SMTP
- Fix registry UI: split /v2/ (registry) and / (UI) into separate Traefik
  routers; add registry_internal network
- Add weekly registry GC cron job (/usr/local/bin/registry-gc)
- Remove rate-limit middleware from Gitea router (act_runner polling
  exceeded 60 req/min limit)
- Set Traefik websecure readTimeout: 0 to fix large layer upload 499s

CLAUDE.md

@@ -75,6 +75,18 @@ The mail role deploys four containers on `mail_internal`: `mail-db` (PostgreSQL
 - Fetchmail 6.6.x rcfile syntax: `ssl` is a user-level option (inline after `password`), port is `smtphost dovecot/24` (slash-separated), `smtpport` keyword does not exist
 - `mail.ladkau.de` is the Roundcube webmail client, not an MTA — no outgoing SMTP server is configured
 
+### Clay (Claude Code web interface)
+
+Clay (`agent.ladkau.de`) provides a browser-based UI for Claude Code. The role
+builds a Docker image from `ansible/roles/clay/files/Dockerfile` (Node 20 +
+`@anthropic-ai/claude-code` + `clay-server`) at deploy time. Key details:
+
+- `ANTHROPIC_API_KEY` is passed as an environment variable from the vault
+- Sessions and config are persisted at `/opt/clay/data` → `/root/.clay` in container
+- Projects (git repos) are mounted from `/opt/clay/workspace` → `/workspace`
+- Traefik basic auth (`clay-auth` middleware) uses `clay_users` from the vault
+- Scheduled agent workflows use Gitea Actions `on.schedule` + the existing act_runners
+
 ### Gitea Actions runners
 
 The `act_runner` role deploys three `gitea/act_runner` containers (Docker executor). Each runner handles one concurrent job. Key details: